homepage: sectioned panels, WIP open/closed, current model facts, Tautulli card

Both pages now group their panels under section headings rendered by shared
renderSection()/renderPanel() components in app.js (SECTION_ORDER fixes each
page's order: user = AI, Web Apps, Media Library Apps; admin = Media Library
Apps, Observability, AI, Infrastructure). The WIP badge splits into WIP: OPEN
and WIP: CLOSED via the wip value ("open"/"closed"); the checker passes the
value through as wip-open/wip-closed. The frank-large card follows the
unsloth llama.cpp cutover, frank-medium follows the FP8 checkpoint, and the
/docs model guide matches. Tautulli (Plex statistics, 192.168.0.235:8181)
joins the admin page's Media Library Apps section with an open link.

serverAppConfigs-docs/Infrastructure/Homepage.md

@@ -17,6 +17,16 @@ remain a separate thread. The three LLM cards (`frank-large`, `frank-medium`,
 `frank-small`) moved from admin-only to the **user** page with live model
 descriptions and a `docs` link to `/docs#models`.
 
+**Sections + WIP split (2026-09-21):** both pages now group their panels
+under section headings rendered by shared `renderSection()`/`renderPanel()`
+components in `app.js`. The user page orders **AI, Web Apps, Media Library
+Apps**; the admin page orders **Media Library Apps, Observability, AI,
+Infrastructure**. The WIP badge split into **WIP: OPEN** (work in progress)
+and **WIP: CLOSED** (work finished by decision — e.g. a card that is
+deliberately unprobeable) via the `wip` value (`"open"` / `"closed"`).
+Tautulli (Plex statistics, `192.168.0.235:8181`) joined the admin page's
+Media Library Apps section.
+
 ## Design decision — 2026-08-22
 
 The live up/down check runs server-side. A checker on Dankclaw probes each backend and writes a same-origin `status.json`. The page fetches only that file and renders the badges. The browser never calls a backend directly. The checker runs as a systemd timer every 3 minutes.
@@ -57,15 +67,20 @@ Each service shows one of three states.
 stateDiagram-v2
     [*] --> Up
     [*] --> Down
-    [*] --> WIP
+    [*] --> WipOpen: wip = "open"
+    [*] --> WipClosed: wip = "closed"
     Up --> Down: probe fails
     Down --> Up: probe succeeds
-    WIP --> Up: work completes
+    WipOpen --> Up: work completes
+    WipClosed --> Up: card becomes probeable
 ```
 
 - **Up** — the probe reached the backend.
 - **Down** — the probe failed (connection refused or timeout).
-- **WIP** — a static override. The service is intentionally not finished. The checker does not probe it.
+- **WIP: Open** — work is in progress. The checker does not probe it.
+- **WIP: Closed** — the work is closed by decision (for example a card that
+  is deliberately unprobeable, with the reason in its description). The
+  checker does not probe it.
 
 ## Checker
 
@@ -86,13 +101,16 @@ flowchart TD
 
 ## Service classification
 
-**User services** (root page): SearXNG, OpenWebUI, Gitea, Calibre-Web, RomM, Copyparty, Plex, Jellyfin, and the three LLM fleet cards (frank-large, frank-medium, frank-small — status + docs link, no Open link).
+**User services** (root page), in section order:
+- **AI** — OpenWebUI, and the three LLM fleet cards (frank-large, frank-medium, frank-small — status + docs link, no Open link).
+- **Web Apps** — SearXNG, Gitea, Copyparty, Marreta.
+- **Media Library Apps** — Calibre-Web, RomM, Plex, Jellyfin, Seerr.
 
-**Admin services** (`/admin/`): Hermes, Grafana, Prometheus, Loki, Caddy, Pi-hole, Gluetun, and the low-level backends (mariadb, redis, Postgres, node-exporter, alloy). The backends show status only. They get a link only where a UI is meaningful.
-
-**Excluded from the listing:** the *arr stack + qBittorrent (Prowlarr, Sonarr,
-Radarr, Lidarr, Readarr, qB) — live on FrankBook-Pro but operator-only: no
-vhosts, direct IP:port access only. See [[FrankBook-Pro]].
+**Admin services** (`/admin/`), in section order:
+- **Media Library Apps** — the *arr stack (Prowlarr, Sonarr, Radarr, Lidarr, Readarr), qBittorrent, and Tautulli — live on FrankBook-Pro and Dankserver, operator-only: no vhosts (Tautulli included), direct IP:port access only. See [[FrankBook-Pro]].
+- **Observability** — Grafana, Prometheus, Loki, node-exporter, alloy, alertmanager.
+- **AI** — Hermes, ComfyUI.
+- **Infrastructure** — Caddy, dnsmasq, Gluetun, and the low-level backends (mariadb, valkey, Postgres). The backends show status only. They get a link only where a UI is meaningful.
 
 ## Layout
 
@@ -111,7 +129,12 @@ shared/homepage/
 
 ## Rendering
 
-The page renders a **grid of TUI-style panels** — one panel per service. Each panel shows the state badge, the name, the description, and the `Open` and `Docs` links. A summary line at the top counts the states. The footer shows the last master deployment datetime (Q43).
+The page renders **sections of TUI-style panels** — one panel per service,
+grouped under a section heading. Each panel shows the state badge, the name,
+the description, and the `Open` and `Docs` links. Section and panel are
+shared components (`renderSection()` / `renderPanel()` in `app.js`); each
+page's section order is fixed by `SECTION_ORDER`. A summary line at the top
+counts the states. The footer shows the last master deployment datetime (Q43).
 
 The page reads `status.json` **once on load**. It does not auto-refresh (Q41).
 
@@ -175,6 +198,7 @@ agent knowledge base (`~/.pi/agent/docs/caddy/caddyfile.md`).
 {
   "name": "SearXNG",
   "category": "user",
+  "section": "Web Apps",
   "description": "Privacy-respecting metasearch engine.",
   "url": "http://search.franksdank.cloud",
   "docs": "/docs/searxng/",
@@ -186,11 +210,16 @@ agent knowledge base (`~/.pi/agent/docs/caddy/caddyfile.md`).
 ```
 
 - `category` — `user` or `admin`. Selects the page.
+- `section` — the heading the panel renders under. Must be one of the page's
+  `SECTION_ORDER` entries (user: AI, Web Apps, Media Library Apps; admin:
+  Media Library Apps, Observability, AI, Infrastructure), or the panel is
+  silently dropped from the page.
 - `url` — the "Open" link (the Caddy site).
 - `docs` — the per-service docs page (`/docs/<svc>/`).
 - `probe` — the backend `host:port` the checker probes.
 - `method` — `tcp` or `http`. The probe type for this service (Q10).
-- `wip` — when true, the badge shows WIP and the checker skips the probe.
+- `wip` — `false`, or `"open"` / `"closed"`. When set, the badge shows
+  **WIP: OPEN** or **WIP: CLOSED** and the checker skips the probe.
 
 **A card must be probeable from the monitor's host, or it must be `wip`.** The
 checker runs on Dankclaw, so its reach is: that host's own loopback, its own