homepage: sectioned panels, WIP open/closed, current model facts, Tautulli card

Both pages now group their panels under section headings rendered by shared
renderSection()/renderPanel() components in app.js (SECTION_ORDER fixes each
page's order: user = AI, Web Apps, Media Library Apps; admin = Media Library
Apps, Observability, AI, Infrastructure). The WIP badge splits into WIP: OPEN
and WIP: CLOSED via the wip value ("open"/"closed"); the checker passes the
value through as wip-open/wip-closed. The frank-large card follows the
unsloth llama.cpp cutover, frank-medium follows the FP8 checkpoint, and the
/docs model guide matches. Tautulli (Plex statistics, 192.168.0.235:8181)
joins the admin page's Media Library Apps section with an open link.

tests/homepage_config.bats

@@ -1,8 +1,9 @@
 #!/usr/bin/env bats
 # Seam: shared/homepage/services.json — the service config the checker reads
 # and the pages render. It must be a JSON list; every entry carries name,
-# category, and a host:port probe. category is user or admin. method, when
-# present, is tcp or http.
+# category, section, and a host:port probe. category is user or admin;
+# section must be one the page's SECTION_ORDER renders. method, when
+# present, is tcp or http. wip, when set, is "open" or "closed".
 
 load helpers
 
@@ -17,16 +18,34 @@ except FileNotFoundError:
 assert isinstance(data, list), "top level must be a list"
 assert data, "the list must not be empty"
 for svc in data:
-    for field in ("name", "category", "probe"):
+    for field in ("name", "category", "section", "probe"):
         assert field in svc, f"{svc.get('name', '?')} is missing {field}"
     assert svc["category"] in ("user", "admin"), svc["category"]
     if "method" in svc:
         assert svc["method"] in ("tcp", "http"), svc["method"]
+    wip = svc.get("wip")
+    assert wip is False or wip in ("open", "closed"), f"{svc['name']} wip must be false, 'open' or 'closed'"
     host, _, port = svc["probe"].rpartition(":")
     assert host and port.isdigit(), f"bad probe {svc['probe']}"
 PY
 }
 
+@test "services.json: every section is one the page renders" {
+    # A service whose section is not in app.js's SECTION_ORDER for its
+    # category is silently dropped from the page. Pin the contract.
+    python3 - "$REPO_ROOT/shared/homepage/services.json" <<'PY'
+import json, sys
+data = json.load(open(sys.argv[1]))
+allowed = {
+    "user": {"AI", "Web Apps", "Media Library Apps"},
+    "admin": {"Media Library Apps", "Observability", "AI", "Infrastructure"},
+}
+for svc in data:
+    assert svc.get("section") in allowed[svc["category"]], (
+        f"{svc['name']} has unrenderable section {svc.get('section')!r} for {svc['category']}")
+PY
+}
+
 @test "services.json: every user service has an Open link, status-only backends do not" {
     python3 - "$REPO_ROOT/shared/homepage/services.json" <<'PY'
 import json, sys