Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-fleet/overlays/ns1/machines.json

@@ -0,0 +1,54 @@
+{
+  "machines": [
+    {
+      "id": "local",
+      "title": "NS1 control plane (Proxmox host)",
+      "kind": "local",
+      "host": "127.0.0.1",
+      "enabled": true,
+      "capacity": 32,
+      "roles": ["*"]
+    },
+    {
+      "id": "ns1",
+      "title": "NS1.GEORGELAMBERT.ORG SSH profile",
+      "kind": "ssh",
+      "host": "70.88.205.138",
+      "user": "marchon",
+      "sshPort": 22,
+      "identityFile": "~/.ssh/id_ed25519",
+      "remoteDir": "~/verae-fleet-runtime",
+      "enabled": false,
+      "capacity": 24,
+      "roles": ["tree-node", "archive-worm", "archive-aggregator", "job-poller", "webhook-deliver"],
+      "notes": "Same box as local; SSH spawn unused on all-in-one."
+    },
+    {
+      "id": "lan-134",
+      "title": "70.88.205.134",
+      "kind": "ssh",
+      "host": "70.88.205.134",
+      "user": "marchon",
+      "sshPort": 22,
+      "identityFile": "~/.ssh/id_ed25519",
+      "remoteDir": "~/verae-fleet-runtime",
+      "enabled": false,
+      "capacity": 12,
+      "roles": ["tree-node", "archive-worm"]
+    },
+    {
+      "id": "px-worker",
+      "title": "Proxmox LXC 510 verae-px-worker",
+      "kind": "ssh",
+      "host": "10.10.10.20",
+      "user": "marchon",
+      "sshPort": 22,
+      "identityFile": "~/.ssh/id_ed25519",
+      "remoteDir": "~/verae-fleet-runtime",
+      "enabled": true,
+      "capacity": 12,
+      "roles": ["tree-node", "archive-worm"],
+      "notes": "vmbr1 LXC 510. SSH as marchon@10.10.10.20 with ~/.ssh/id_ed25519."
+    }
+  ]
+}