Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-fleet/machines.json

@@ -42,6 +42,20 @@
       "capacity": 12,
       "roles": ["tree-node", "archive-worm"],
       "notes": "Same user/key as NS1. Enable after confirming node is on PATH."
+    },
+    {
+      "id": "px-worker",
+      "title": "Proxmox LXC 510 verae-px-worker",
+      "kind": "ssh",
+      "host": "10.10.10.20",
+      "user": "marchon",
+      "sshPort": 22,
+      "identityFile": "~/.ssh/id_ed25519",
+      "remoteDir": "~/verae-fleet-runtime",
+      "enabled": true,
+      "capacity": 12,
+      "roles": ["tree-node", "archive-worm"],
+      "notes": "Unprivileged Ubuntu CT 510 on NS1 vmbr1. ssh marchon@10.10.10.20."
     }
   ]
 }