Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-backup/systemd/verae-backup.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Verae data backup (sqlite, keep, worm/tree, jetstream)
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/verae-src/verae-backup
+ExecStart=/usr/bin/bash %h/verae-src/verae-backup/scripts/backup.sh

packages/verae-backup/systemd/verae-backup.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Nightly Verae data backup
+
+[Timer]
+OnCalendar=*-*-* 03:17:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target