feat(homepage): the not-open-yet apps get their own section, below AI

Calibre-Web, RomM and Seerr sat inside "Media Library Apps" carrying a WIP
badge and a "not open to family users yet" sentence each, so the household
grid mixed doors they can use with doors they cannot. They now render under
their own "Work in progress" heading, placed after AI on the user page, and
the copy drops the restated "Work in progress:" for the ask-Frank line the
section heading no longer needs to repeat.

- app.js: SECTION_ORDER.user gains "Work in progress" last.
- services.json: the three cards' section, plus one-line copy trim.
- homepage_config.bats / homepage_pages.bats: the section contract now
  includes the new heading and pins the new order (the old test pinned AI
  last, which this change deliberately overturns).
- Homepage.md: the classification list and the SECTION_ORDER/wip contract
  lines catch up (the user order in the page was already stale, and "down"
  was an undocumented wip value).

The admin page is untouched: its WIP cards (Gluetun, mariadb, valkey,
Postgres) are plumbing inside Infrastructure, not applications.

tests/homepage_config.bats

@@ -37,7 +37,7 @@ PY
 import json, sys
 data = json.load(open(sys.argv[1]))
 allowed = {
-    "user": {"AI", "Web Apps", "Media Library Apps"},
+    "user": {"AI", "Web Apps", "Media Library Apps", "Work in progress"},
     "admin": {"Media Library Apps", "Observability", "AI", "Infrastructure"},
 }
 for svc in data: