migrate id (Pocket-ID) CT 110 → CT 109; destroy CT 110

- Pocket-ID now on CT 109 ops at :11000 (was CT 110 :11000)
- Zoraxy id.nuclide.systems → 192.168.1.8:11000
- AdGuard id.nuclide.lan → 192.168.1.8
- Homepage docker.yaml: removed ct110/ct111/ct112 (all destroyed)
- Homepage services.yaml: pocket-id server: my-local
- pocket-id.md: updated host, client table CTs corrected
- portainer.md: CT 110 row struck through
- portmap, ct-inventory, zoraxy all updated
- CT 110 LXC destroyed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/portmap.md

@@ -38,11 +38,12 @@
 | [9221](http://192.168.1.8:9221) | CT 109 | pve-exporter | Proxmox VE metrics; auth: `monitor@pve!prometheus` |
 | [12345](http://192.168.1.8:12345) | CT 109 | Alloy (self) | agent UI; also runs on all other hosts at :12345 |
 | [4090](http://192.168.1.8:4090) | CT 109 | Wetty | LAN only (127.0.0.1); web SSH → jump-menu.sh on nuc |
-| [10000](http://192.168.1.8:10000) | CT 109 | Homepage | LAN only (`ops.nuclide.lan:10000`); service dashboard; remote Docker via socket-proxy :2375 on CT 110/111/112/113, direct TCP on CT 104 |
+| [10000](http://192.168.1.8:10000) | CT 109 | Homepage | LAN only (`ops.nuclide.lan:10000`); service dashboard; remote Docker via socket-proxy :2375 on CT 113, direct TCP on CT 104 |
 | [10001](http://192.168.1.8:10001) | CT 109 | Dozzle | LAN only; live log viewer; agents on all 7 Docker hosts |
 | ~~10002~~ | ~~CT 109~~ | ~~Arcane~~ | **DECOMMISSIONED 2026-05-26** — replaced by Portainer |
 | [13080](http://192.168.1.8:13080) | CT 109 | docs-server | LAN only; mkdocs Material; auto-rebuilds from `fkrebs/docs` every 5 min — migrated from CT 111 2026-05-23 |
 | [8200](http://192.168.1.8:8200) | CT 109 | Infisical | LAN only; secrets manager; migrated from CT 112 2026-05-26; `http://secrets.nuclide.lan:8200` |
+| [11000](http://192.168.1.8:11000) | CT 109 | Pocket-ID | `https://id.nuclide.systems`; OIDC IdP; migrated from CT 110 2026-05-26 |
 | 9100 | CT 109 | node-exporter | host-network, self-scrape |
 | 9100 | CT 104 | node-exporter | standalone stack `/opt/stacks/monitoring/`; scraped by CT 109 |
 
@@ -87,7 +88,7 @@ Scrape targets (CT 109 Prometheus): ~~`litellm` CT104:14000/metrics/~~ (**SUNSET
 |---|---|---|---|---|
 | [11001](http://192.168.1.40:11001) | Vaultwarden | `vaultwarden` | [vault.nuclide.systems](https://vault.nuclide.systems) | Password manager · Pocket-ID OIDC client created 2026-05-21; auth flow not yet configured |
 
-> Pocket-ID **migrated from this CT to LXC 110** on 2026-05-20. See the [External Services](#external-services-not-on-nuc-docker) table below.
+> Pocket-ID **migrated from this CT to LXC 110** on 2026-05-20, then **to CT 109** on 2026-05-26. See the [External Services](#external-services-not-on-nuc-docker) table below.
 
 ---
 
@@ -243,7 +244,7 @@ Zoraxy routes to these external backends:
 | [ocpp.nuclide.systems](https://ocpp.nuclide.systems) | `192.168.1.60:8887` | Home Assistant VM 100 | EV charger OCPP |
 | [shepard.nuclide.systems](https://shepard.nuclide.systems) | `192.168.1.49:80` | Shepard LXC 101 | Shepard |
 | [shepard-api.nuclide.systems](https://shepard-api.nuclide.systems) | `192.168.1.49:8080` | Shepard LXC 101 | Shepard API |
-| [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.5:11000` | Pocket-ID LXC 110 | OIDC IdP (migrated 2026-05-20) |
+| [id.nuclide.systems](https://id.nuclide.systems) | `192.168.1.8:11000` | Ops CT 109 | Pocket-ID OIDC IdP (migrated CT110→CT109 2026-05-26) |
 | [git.nuclide.systems](https://git.nuclide.systems) | `192.168.1.40:3000` | Docker CT 104 | Gitea (migrated from CT 111 2026-05-26) |
 | [dev.nuclide.systems](https://dev.nuclide.systems) | `192.168.1.40:7080` | Docker CT 104 | Coder (migrated from CT 111 2026-05-26) |
 | Gitea SSH | `192.168.1.40:222` | Docker CT 104 | `ssh -p 222 git@git.nuclide.systems` |