Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-fleet/systemd/verae-fleet.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=Verae fleet operator console
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=%h/verae-stack/packages/verae-fleet
+Environment=FLEET_FILE=%h/verae-stack/packages/verae-fleet/overlays/ns1/fleet.json
+Environment=FLEET_MACHINES=%h/verae-stack/packages/verae-fleet/overlays/ns1/machines.json
+Environment=STAFF_IAM_URL=https://iam.zapier.georgelambert.org
+Environment=STAFF_COOKIE_DOMAIN=.zapier.georgelambert.org
+Environment=NATS_URL=nats://127.0.0.1:4222
+Environment=FLEET_ENABLE_LAN134=
+ExecStart=/usr/bin/node src/cli.js serve
+Restart=always
+RestartSec=2
+
+[Install]
+WantedBy=default.target