Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/docs-master/modules/verae-backup/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-backup
+
+Copies JetStream store directory if present. No client connection.

packages/docs-master/modules/verae-backup/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-backup
+
+Nightly tar of SQLite, IAM, keep, worm/tree runtime, optional JetStream dir. Restore is dry-run unless `--apply`.

packages/docs-master/modules/verae-deploy/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-deploy
+
+None during deploy. Archive hosts still need nats-server from host-deps.

packages/docs-master/modules/verae-deploy/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-deploy
+
+`host-deps` + git checkout tag/branch + npm ci/rebuild on the target OS. Restart keep/fleet after.

packages/docs-master/modules/verae-proxmox/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-proxmox
+
+Guest clients use `nats://10.10.10.1:4222` (socat to host loopback). Never bind NATS on vmbr0.

packages/docs-master/modules/verae-proxmox/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-proxmox
+
+LXC 510 `verae-px-worker` on NS1 `vmbr1` `10.10.10.20`. Extra worm/tree copies. Private NATS proxy `10.10.10.1:4222`.

packages/docs-master/modules/verae-uptime/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-uptime
+
+None. HTTPS only.

packages/docs-master/modules/verae-uptime/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-uptime
+
+Off-box HTTPS GET of public doors. `--once` for cron (exit 2 on failure); loop serves `/status` on `:3870`.