feat(trainer): training from the collector UI — the trainer becomes a job service, the review page gains a Training section

Trainer: `parking-trainer serve` — a stdlib HTTP job API on the compose network (never
published): /health, /readiness, /versions, /versions/<v>/report, /jobs. One job at a
time; each job runs the CLI as a subprocess with its output captured, state + log
persisted under /out/jobs/ so a restart keeps history. `publish` takes its URL from
TRAINER_PUBLISH_URL. Dockerfile: CMD serve, EXPOSE 8091, healthcheck.

Collector: COLLECTOR_TRAINER_URL + /api/training/{status,jobs,jobs/:id,versions/:v/report}
— a reviewer-gated proxy that forwards a fixed set of paths and whitelisted knobs and
passes the trainer's status codes through (409 while a job runs; 503 unconfigured, 502
unreachable). /review gains the Training section: labels per class vs the minimum with
Train disabled until two classes clear it, mode / backbone / floor, the running job's
live log, the versions with Report / Evaluate / Publish (publish confirms), and the
reminder that pinning stays a git commit. Fixed on the way: an apostrophe in the page's
inline script broke the whole page — a test now parses the script.

Compose: `trainer` is a service (restart: unless-stopped, read-only data volume, its own
trainer-out volume), the `train` profile and TRAINER_OUT are gone; the Docker-socket
route was rejected (root on the host for a service booths upload to). Verified with both
images running together: a Train started through the proxy finished, version and report
came back, the page rendered.

Wiki: bodytype-classifier-training (loop, running it, operating notes superseded),
vision-review-outbox, fleet-deployment-komodo, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/decisions/fleet-deployment-komodo.md

@@ -158,11 +158,10 @@ collector ([[vision-review-outbox]]) runs on the reviewer's GPU host as its own
 (`wash-collector`, `server = "art-docker-station"`, `file_paths = ["docker-compose.collector.yml"]`).
 Same repo, branch and pinned `TAG` promotion, its own secret references, and — because a stack
 names its compose files — nothing booth-side lands on that host and nothing of it on a booth.
-The same stack carries the phase-B **trainer** as a compose *profile* (`train`,
-[[bodytype-classifier-training]]): a deploy never starts it; the owner runs it by hand on the host
-with `docker compose … --profile train run --rm trainer …`. So after a deploy of that stack
-`docker ps` shows one container — expected; and a deploy pulls nothing for the profile, the
-first `run` does (host Docker must be logged in to the registry). Its two env lines (`TRAINER_OUT`, the
+The same stack carries the phase-B **trainer** as a second service ([[bodytype-classifier-training]]):
+a deploy starts both, `docker ps` shows two containers, and the trainer is driven from the
+collector's UI, never from the host's shell (a first cut as a compose *profile* run by hand was
+replaced the same day — the host runs a periphery, nobody should be typing compose there). Its two env lines (`TRAINER_OUT`, the
 `TRAINER_PUBLISH_TOKEN` secret reference) stay commented in `resources.toml` until the first
 publish.