Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-backup/scripts/test.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+bash -n "$ROOT/scripts/backup.sh"
+bash -n "$ROOT/scripts/restore.sh"
+TMP="$(mktemp -d)"
+export BACKUP_ROOT="$TMP/out"
+export ZAPPIER_DB="$TMP/zappier.db"
+export IAM_DATA="$TMP/iam"
+export KEEP_DATA="$TMP/keep"
+export FLEET_RUNTIME="$TMP/runtime"
+export FLEET_PKG_DATA="$TMP/fleet-pkg"
+export NATS_STORE="$TMP/missing-nats"
+echo hello >"$ZAPPIER_DB"
+mkdir -p "$IAM_DATA" "$KEEP_DATA" "$FLEET_RUNTIME" "$FLEET_PKG_DATA"
+echo x >"$KEEP_DATA/a"
+# shellcheck disable=SC1091
+set +u
+BACKUP_ROOT="$BACKUP_ROOT" KEEP=3 ZAPPIER_DB="$ZAPPIER_DB" IAM_DATA="$IAM_DATA" KEEP_DATA="$KEEP_DATA" FLEET_RUNTIME="$FLEET_RUNTIME" FLEET_PKG_DATA="$FLEET_PKG_DATA" NATS_STORE="$NATS_STORE" \
+  bash "$ROOT/scripts/backup.sh" >/tmp/verae-backup-test.out
+test -s /tmp/verae-backup-test.out
+ls "$BACKUP_ROOT"/*.tgz >/dev/null
+BACKUP_ROOT="$BACKUP_ROOT" ZAPPIER_DB="$ZAPPIER_DB" IAM_DATA="$IAM_DATA" KEEP_DATA="$KEEP_DATA" FLEET_RUNTIME="$FLEET_RUNTIME" FLEET_PKG_DATA="$FLEET_PKG_DATA" NATS_STORE="$NATS_STORE" \
+  bash "$ROOT/scripts/restore.sh" --dry-run >/dev/null
+rm -rf "$TMP"
+echo OK