fleet-manager: checkpoint 7 — deployment (compose, PKI, deploy runbook, design-doc updates)

Complete the deployment story for the server-side control plane:

- docker-compose.yml: private InfluxDB (published to loopback only) + a
  host-networked fleet-manager (reaches the loopback enrol-broker on
  127.0.0.1:9443 and binds a routable gRPC agent listener, like the broker).
- .env.example: RP origin (diskless-server.bitasylum.org), Influx token/DB
  password, cert/PKI paths; the Influx token wires influxdb + manager with
  one value.
- server-pki.sh: issue the agent-plane server cert from the fleet CA (step)
  and stage the fleet root as the client-verify CA.
- DEPLOY.md: end-to-end runbook — three-cert PKI (fleet-CA agent cert, broker
  admin-client cert, Let's Encrypt DNS-01 UI cert), register-admin passkey
  bootstrap, compose up, hardware-free smoke test, backups.
- .dockerignore: keep host node_modules/dist/pki/secrets out of the build
  context so the embedded SPA is the one built in-image.
- .gitignore: never commit .env / issued PKI / data.

Design docs marked as-built: fleet-management-design.md as-built note
(resolved forks — gRPC bidi transport, InfluxDB metrics, SPA graphs, passkey
admin auth, broker fold-in "alongside"); tpm-enrolment-design.md (broker
fold-in + agent transport fork resolved); TODO.md #14 → partly built, with
the on-host agent + per-host boot-version assignment (#6) called out as the
remaining work.

serving/fleet-manager/README.md

@@ -137,7 +137,15 @@ inventory for offline delivery. Metrics writing is behind a `MetricsSink`
 | `FLEET_MGR_SEED` | `false` | inject demo hosts so the SPA has data — dev only |
 | `HOSTNQN_BASE` | `nqn.2026-06.org.example.fleet:host-` | hostnqn prefix (match the broker) |
 
-InfluxDB env lands in checkpoint 4.
+## Deploy
+
+Full bring-up (PKI, Let's Encrypt DNS-01, `register-admin`, compose) is in
+[`DEPLOY.md`](DEPLOY.md). In short: `cp .env.example .env` → `./server-pki.sh` +
+`../enrol-broker/admin-pki.sh … fleet-manager` → `docker compose up -d influxdb`
+→ `docker compose run --rm fleet-manager register-admin <you>` → `docker compose
+up -d fleet-manager`. InfluxDB is private (published to loopback only); the
+manager uses host networking to reach the loopback broker + bind a routable
+agent listener.
 
 ## Dev run
 
@@ -175,4 +183,9 @@ curl -s localhost:9500/api/hosts | jq '.hosts[] | {name:.identity.starship_name,
   Lifecycle + bespoke SVG charts. Embedded via `go:embed` behind the `embedspa`
   build tag; served same-origin over the admin plane. Smoke-tested end-to-end
   (index + assets + API through the SPA origin).
-- Next: Docker/compose + PKI/RP/ACME + docs (ckpt 7).
+- **Checkpoint 7 (done):** deployment — three-stage `Dockerfile` (npm→dist→
+  `go build -tags embedspa`→distroless), `docker-compose.yml` (private InfluxDB +
+  host-networked manager), `.env.example`, `server-pki.sh` (agent-plane fleet-CA
+  server cert), and [`DEPLOY.md`](DEPLOY.md) (PKI, LE DNS-01, `register-admin`
+  bootstrap). Design docs updated (manager marked built; resolved transport/auth/
+  metrics forks; per-host-versioning gap recorded).