Document every repo in Sphinx, catalog PDFs, and verae-ops

Add missing package READMEs, expand Sphinx to all runtime modules,
publish a LaTeX/PDF README book, and add verae-ops for Docker,
Proxmox, VMs, dedicated hardware, and service linking. Catalog
defaults to public PDF links for each module README and samples.

docs/sphinx/modules/verae-fleet/ssh.md

@@ -0,0 +1,55 @@
+# `verae-fleet/ssh`
+
+**Package:** `verae-fleet`  
+**Source:** `packages/verae-fleet/src/ssh.js`  
+**Lines:** 171
+
+## What this module is
+
+Implementation module in `verae-fleet`. The tables below are extracted from the source (signatures + JSDoc).
+
+## Exports
+
+`expandHome`, `shellQuote`, `sshTarget`, `sshBaseArgs`, `scpBaseArgs`, `sshExec`, `scpTo`, `ensureRemoteRuntime`, `sshSpawnWorker`, `sshKillWorker`, `sshHttp`, `sshCheck`
+
+## Types / interfaces / classes
+
+_None extracted._
+
+## Functions
+
+| Name | Parameters | Param types (JSDoc) | Returns | Calls (same file / helpers) |
+|------|------------|---------------------|---------|-----------------------------|
+| `expandHome` | `p` | — | `unknown` | see Call graph |
+| `shellQuote` | `s` | — | `unknown` | see Call graph |
+| `sshTarget` | `machine` | — | `unknown` | see Call graph |
+| `sshBaseArgs` | `machine` | — | `unknown` | see Call graph |
+| `scpBaseArgs` | `machine` | — | `unknown` | see Call graph |
+| `sshExec` | `machine, remoteCommand, { timeoutMs = 20000 } = {}` | — | `unknown` | see Call graph |
+| `scpTo` | `machine, localFiles, remoteDir` | — | `unknown` | see Call graph |
+| `ensureRemoteRuntime` | `machine` | — | `unknown` | see Call graph |
+| `sshSpawnWorker` | `machine, { instance, env }` | — | `unknown` | see Call graph |
+| `sshKillWorker` | `machine, pid, instance` | — | `unknown` | see Call graph |
+| `sshHttp` | `machine, method, urlPath, { port, body } = {}` | — | `unknown` | see Call graph |
+| `sshCheck` | `machine` | — | `unknown` | see Call graph |
+
+## What it imports / requires
+
+- `node:child_process`
+- `node:fs`
+- `node:os`
+- `node:path`
+- `node:url`
+
+## Call graph (identifiers invoked)
+
+`dirname`, `fileURLToPath`, `expandHome`, `homedir`, `startsWith`, `join`, `slice`, `shellQuote`, `replace`, `sshTarget`, `sshBaseArgs`, `existsSync`, `push`, `scpBaseArgs`, `sshExec`, `spawn`, `on`, `setTimeout`, `kill`, `reject`, `clearTimeout`, `concat`, `toString`, `trim`, `resolve`, `scpTo`, `ensureRemoteRuntime`, `has`, `add`, `sshSpawnWorker`, `entries`, `filter`, `map`, `split`, `pop`, `isFinite`, `sshKillWorker`, `sshHttp`, `stringify`, `parse`, `sshCheck`
+
+Each identifier is a call site in this file. Follow the import list to see the defining module; open that module’s MD for parameter and return types.
+
+## Return values (how to read this)
+
+- HTTP route handlers return Express `res.json(...)` bodies (see route docs).
+- Zapier `perform` functions return a **single object** (creates) or an **array** (triggers/searches).
+- Pricing functions return integer **cents** on `Quote.totalCents`.
+