Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-backup/scripts/backup.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Snapshot Verae data dirs into $BACKUP_ROOT/<utc-stamp>.tgz
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck disable=SC1091
+. "$ROOT/paths.env"
+STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
+DEST="$BACKUP_ROOT/$STAMP"
+mkdir -p "$DEST"
+copy_if() {
+  local src="$1" name="$2"
+  if [[ -e "$src" ]]; then
+    mkdir -p "$DEST/$name"
+    cp -a "$src" "$DEST/$name/" 2>/dev/null || sudo cp -a "$src" "$DEST/$name/"
+    echo "copied $src"
+  else
+    echo "skip missing $src"
+  fi
+}
+copy_if "$ZAPPIER_DB" sqlite
+copy_if "$IAM_DATA" iam
+copy_if "$KEEP_DATA" keep
+copy_if "$FLEET_RUNTIME" fleet-runtime
+copy_if "$FLEET_PKG_DATA" fleet-pkg
+copy_if "$NATS_STORE" nats
+if [[ -n "${NATS_DOCKER_VOL:-}" ]]; then copy_if "$NATS_DOCKER_VOL" nats-docker; fi
+tar -C "$BACKUP_ROOT" -czf "$BACKUP_ROOT/$STAMP.tgz" "$STAMP"
+rm -rf "$DEST"
+# retain
+ls -1dt "$BACKUP_ROOT"/*.tgz 2>/dev/null | tail -n +$((KEEP + 1)) | while read -r old; do
+  rm -f "$old"
+done
+echo "backup $BACKUP_ROOT/$STAMP.tgz"
+echo "$BACKUP_ROOT/$STAMP.tgz"