feat(deploy): Komodo fleet deployment — resources.toml + decision

Adopt Komodo Periphery (over the NetBird mesh) as the booth fleet control plane,
superseding SSH-and-booth.sh. The booth runs the SAME compose files; Komodo Core
drives them remotely. booth.sh is demoted to a break-glass local fallback.

- komodo/resources.toml mirrors the working park-buzi Stack (built by hand in the
  Core UI, then exported to TOML — field names match the running v2.2). Stack-only:
  servers are created by the agent onboarding OUTBOUND (one-time onboarding key →
  Periphery self-registers, auto-rotating keys, booth opens no inbound port), so
  there is no [[server]] block. Per-booth secrets via [[...]] refs to Core's store.
- komodo/README.md + .env.komodo.example document the flow and the hard rules
  (no webhook; onboarding/outbound/mesh-only; per-booth unique secrets; never
  down -v the ledger volume).
- wiki/decisions/fleet-deployment-komodo.md records the decision + threat-model
  analysis (Periphery is a root agent → mesh-bound; EVENT_SIGNING_KEY-in-Core is a
  fraud-root blast radius until ATECC608 signs; Core is now Tier-0; GPL-3.0 is fine
  as external ops tooling). container-deployment reframed (booth.sh = fallback);
  index + log updated.

Verified end-to-end against a real booth (park-buzi): onboarded OK, Stack deployed,
all containers green, admin seeded.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

komodo/resources.toml

@@ -0,0 +1,51 @@
+# Komodo resources — parking appliance fleet (control plane as code)
+#
+# Synced into Komodo Core via a ResourceSync pointing at this file. Drives the SAME
+# compose files the booth runs locally (docker-compose.yml + docker-compose.prod.yml);
+# Komodo Periphery on each booth executes them. See:
+#   wiki/decisions/fleet-deployment-komodo.md   (rationale + threat model)
+#   wiki/decisions/container-deployment.md       (image build/tag/registry — unchanged)
+#
+# This file mirrors the WORKING park-buzi Stack (built by hand in the Core UI, then
+# exported to TOML). Field names match the running Komodo version (v2.2).
+#
+# NO [[server]] block: servers are created by the AGENT onboarding outbound (a one-time
+# onboarding key → Periphery self-registers with auto-rotating key pairs). The sync owns
+# only the Stack; it references the server by the name it onboarded as (`connect_as`).
+#
+# Secrets ([[park_buzi_jwt_secret]] etc.) are REFERENCES to Komodo Core's secret store —
+# per-booth + unique, never inlined here (this file is in git). JWT_SECRET gates login;
+# EVENT_SIGNING_KEY signs the append-only anti-fraud ledger.
+#
+# Deploys are MANUAL + PINNED in spirit: bump TAG to an immutable dev-<sha> before a
+# production booth goes live (TAG=dev here is the moving tag, fine while staging). NO
+# deploy webhook is attached to a booth Stack.
+
+##############################################################################
+# Stack — the deployable unit for booth "park-buzi". One Stack per booth; add a
+# new [[stack]] block per site (unique name, its own per-booth secret refs).
+##############################################################################
+
+[[stack]]
+name = "park-buzi"
+[stack.config]
+server = "park-buzi"
+git_provider = "git.infra.msai.al"
+git_account = "komodo"
+repo = "mca/parking_solution"
+branch = "dev"
+file_paths = [
+  "docker-compose.yml",
+  "docker-compose.prod.yml"
+]
+registry_provider = "git.infra.msai.al"
+registry_account = "komodo"
+environment = """
+REGISTRY=git.infra.msai.al/mca/parking_solution
+TAG=dev
+COOKIE_SECURE=0
+VISION_ENABLED=1
+WS_ALLOWED_ORIGINS=
+JWT_SECRET=[[park_buzi_jwt_secret]]
+EVENT_SIGNING_KEY=[[park_buzi_event_signing_key]]
+"""