feat(deploy): Komodo fleet deployment — resources.toml + decision

Adopt Komodo Periphery (over the NetBird mesh) as the booth fleet control plane,
superseding SSH-and-booth.sh. The booth runs the SAME compose files; Komodo Core
drives them remotely. booth.sh is demoted to a break-glass local fallback.

- komodo/resources.toml mirrors the working park-buzi Stack (built by hand in the
  Core UI, then exported to TOML — field names match the running v2.2). Stack-only:
  servers are created by the agent onboarding OUTBOUND (one-time onboarding key →
  Periphery self-registers, auto-rotating keys, booth opens no inbound port), so
  there is no [[server]] block. Per-booth secrets via [[...]] refs to Core's store.
- komodo/README.md + .env.komodo.example document the flow and the hard rules
  (no webhook; onboarding/outbound/mesh-only; per-booth unique secrets; never
  down -v the ledger volume).
- wiki/decisions/fleet-deployment-komodo.md records the decision + threat-model
  analysis (Periphery is a root agent → mesh-bound; EVENT_SIGNING_KEY-in-Core is a
  fraud-root blast radius until ATECC608 signs; Core is now Tier-0; GPL-3.0 is fine
  as external ops tooling). container-deployment reframed (booth.sh = fallback);
  index + log updated.

Verified end-to-end against a real booth (park-buzi): onboarded OK, Stack deployed,
all containers green, admin seeded.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

komodo/.env.komodo.example

@@ -0,0 +1,24 @@
+# Komodo Stack environment — reference of what a booth Stack needs and WHERE it comes
+# from. Under Komodo, plain env lives in the Stack definition (komodo/resources.toml);
+# the two SECRETS come from Komodo Core's secret store, PER BOOTH and UNIQUE. This file
+# is documentation only — do NOT fill in real secrets here (it would be the same leak
+# we're avoiding). See wiki/decisions/fleet-deployment-komodo.md.
+
+# --- plain Stack env (lives in resources.toml; safe in git) -------------------
+REGISTRY=git.infra.msai.al/mca/parking_solution
+# IMMUTABLE per-commit tag. Manual + pinned. Bump per deploy. Never the moving `dev`
+# on a production booth.
+TAG=dev-830993b
+COOKIE_SECURE=0
+VISION_ENABLED=1
+WS_ALLOWED_ORIGINS=
+
+# --- secrets (Core secret store, referenced by name in resources.toml) --------
+# Generated PER BOOTH (openssl rand -hex 32), registered in Core under booth-scoped
+# names, never reused across sites. The user generates these; they are never typed on
+# a CLI or committed.
+#   JWT_SECRET            -> [[booth_<name>_jwt_secret]]            (login)
+#   EVENT_SIGNING_KEY     -> [[booth_<name>_event_signing_key]]    (ledger signing — fraud root)
+# Periphery/registry auth also live in Core:
+#   periphery passkey     -> [[periphery_passkey_booth_<name>]]
+#   registry account      -> [[gitea_registry_account]]