I have another thermal camera to use for troubleshooting. It's not a short circuit, I blew at least the ethernet driver and other unknown components. I have been testing mosfets, resistors, capacitors, although in-circuit measurements are dicey.
I found a similar optical only camera on eBay made around the same time, I bought it for parts to see if the board can be swapped out. I later realized that the camera dome has a power supply that converts the 24vac down to 12vdc, but the board I pictured does on-board PoE buck conversion.
I found a reputable electronic repair guy who wants $300 to repair it. I'm going to continue to poke and prod, with donor parts, but probably just send it off for repair as this is another project I'll probably never finish.
I did probe this board and the rail I powered went directly to daughter boards and camera modules, which I haven't tested yet. Hopefully I didn't blow them up, too, or I'm left with an expensive pile of junk.