Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-uptime/README.md

@@ -0,0 +1,21 @@
+# verae-uptime
+
+GET-watch the public Verae Time × Zapier doors from a host that is **not** the thing being watched. If NS1 is the only watcher, NS1 dying is silent.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-uptime  
+**SSH:** `ssh://git@git.georgelambert.org:2223/marchon/verae-uptime.git`
+
+Run on a laptop, a second WAN box, or (weaker) a Proxmox CT on the same chassis.
+
+```bash
+git clone ssh://git@git.georgelambert.org:2223/marchon/verae-uptime.git
+cd verae-uptime
+node src/watch.js --once          # exit 2 if any required target failed
+node src/watch.js                 # loop + http://127.0.0.1:3870/status
+```
+
+`probes.json` lists catalog, portal, api, zap, iam, mw, fleet, git. Optional `webhook` POSTs the snapshot when `failed > 0`.
+
+State: `~/.verae-uptime/status.json` and `watch.log`.
+
+This process does **not** speak NATS.