Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-deploy/scripts/deploy.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# host-deps → git fetch → checkout ref → npm ci → npm rebuild
+# Does not start processes; restart with fleet/keep after.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+BOOT="${VERAE_BOOTSTRAP:-$ROOT/../verae-bootstrap}"
+SRC="${VERAE_SRC:-$HOME/verae-src}"
+REF="${1:-}"
+TYPE="${DEPLOY_TYPE:-}"
+if [[ -z "$REF" ]]; then
+  echo "usage: deploy.sh <tag-or-branch>   # e.g. deploy.sh v2026-09-12 or main" >&2
+  exit 1
+fi
+if [[ -x "$BOOT/scripts/host-deps.sh" ]]; then
+  if [[ -n "$TYPE" ]]; then
+    bash "$BOOT/scripts/host-deps.sh" --type "$TYPE"
+  else
+    bash "$BOOT/scripts/host-deps.sh"
+  fi
+fi
+LIST="$BOOT/repos.txt"
+[[ -n "$TYPE" && -f "$BOOT/types/$TYPE/repos.txt" ]] && LIST="$BOOT/types/$TYPE/repos.txt"
+[[ -f "$LIST" ]] || { echo "no repo list $LIST" >&2; exit 1; }
+export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o StrictHostKeyChecking=accept-new -p 2223}"
+failed=0
+while read -r name; do
+  [[ -z "$name" || "$name" == \#* ]] && continue
+  dir="$SRC/$name"
+  if [[ ! -d "$dir/.git" ]]; then
+    echo "skip not cloned $name"
+    continue
+  fi
+  echo "deploy $name @ $REF"
+  git -C "$dir" fetch --prune origin
+  if ! git -C "$dir" checkout -q "$REF" 2>/dev/null; then
+    echo "  no ref $REF, staying on $(git -C "$dir" rev-parse --abbrev-ref HEAD)"
+  fi
+  if [[ -f "$dir/package.json" ]]; then
+    (
+      cd "$dir"
+      if [[ -f package-lock.json ]]; then
+        npm ci --no-audit --no-fund || npm install --no-audit --no-fund
+      else
+        npm install --no-audit --no-fund
+      fi
+      npm rebuild --no-audit --no-fund >/dev/null || true
+    ) || { echo "  npm failed $name"; failed=1; }
+  fi
+  git -C "$dir" rev-parse --short HEAD >"$dir/.deployed-ref"
+  echo "  $(cat "$dir/.deployed-ref")"
+done < "$LIST"
+echo "$REF $(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$SRC/.deployed"
+[[ $failed -eq 0 ]] || exit 1
+echo "deployed $REF under $SRC — restart keep/fleet yourself"