fleet-manager: checkpoint 7 — deployment (compose, PKI, deploy runbook, design-doc updates)

Complete the deployment story for the server-side control plane:

- docker-compose.yml: private InfluxDB (published to loopback only) + a
  host-networked fleet-manager (reaches the loopback enrol-broker on
  127.0.0.1:9443 and binds a routable gRPC agent listener, like the broker).
- .env.example: RP origin (diskless-server.bitasylum.org), Influx token/DB
  password, cert/PKI paths; the Influx token wires influxdb + manager with
  one value.
- server-pki.sh: issue the agent-plane server cert from the fleet CA (step)
  and stage the fleet root as the client-verify CA.
- DEPLOY.md: end-to-end runbook — three-cert PKI (fleet-CA agent cert, broker
  admin-client cert, Let's Encrypt DNS-01 UI cert), register-admin passkey
  bootstrap, compose up, hardware-free smoke test, backups.
- .dockerignore: keep host node_modules/dist/pki/secrets out of the build
  context so the embedded SPA is the one built in-image.
- .gitignore: never commit .env / issued PKI / data.

Design docs marked as-built: fleet-management-design.md as-built note
(resolved forks — gRPC bidi transport, InfluxDB metrics, SPA graphs, passkey
admin auth, broker fold-in "alongside"); tpm-enrolment-design.md (broker
fold-in + agent transport fork resolved); TODO.md #14 → partly built, with
the on-host agent + per-host boot-version assignment (#6) called out as the
remaining work.

serving/fleet-manager/server-pki.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# server-pki.sh — issue the fleet-manager AGENT-plane server cert from the fleet
+# CA, and stage the fleet root as the agent client-verify CA.
+#
+# The agent plane is gRPC + mTLS: enrolled hosts present their TPM identity cert
+# (fleet CA), and they verify the MANAGER's server cert against the same fleet
+# root they hold. So the manager's agent-plane server cert MUST be signed by the
+# fleet CA — this script issues it via `step ca certificate` against the running
+# fleet step-ca (serving/dot1x-bench/), the same CA that signs enrolment certs.
+#
+# This does NOT issue:
+#   - the ADMIN-plane UI cert   -> Let's Encrypt DNS-01 (external ACME client;
+#                                  drop fullchain/privkey into ./pki/admin/). See DEPLOY.md.
+#   - the manager's BROKER client cert -> ../enrol-broker/admin-pki.sh (admin CA):
+#                                  ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager
+#
+# Usage:  server-pki.sh
+#   env overrides:
+#     OUT=./pki/agent                     output dir
+#     AGENT_SANS=diskless-server.bitasylum.org,10.0.0.1   SANs hosts dial (DNS/IP, comma-sep)
+#     FLEET_CA_URL=https://ca.fleet.lab:8443
+#     FLEET_CA_ROOT=../dot1x-bench/pki/root_ca.crt
+#     STEP_PROVISIONER=enrol
+#     STEP_PROVISIONER_PASSWORD_FILE=../dot1x-bench/pki/stepca/secrets/password
+#     CERT_NOT_AFTER=8760h
+set -euo pipefail
+
+OUT=${OUT:-./pki/agent}
+AGENT_SANS=${AGENT_SANS:-diskless-server.bitasylum.org}
+FLEET_CA_URL=${FLEET_CA_URL:-https://ca.fleet.lab:8443}
+FLEET_CA_ROOT=${FLEET_CA_ROOT:-../dot1x-bench/pki/root_ca.crt}
+STEP_PROVISIONER=${STEP_PROVISIONER:-enrol}
+STEP_PROVISIONER_PASSWORD_FILE=${STEP_PROVISIONER_PASSWORD_FILE:-../dot1x-bench/pki/stepca/secrets/password}
+CERT_NOT_AFTER=${CERT_NOT_AFTER:-8760h}
+
+command -v step >/dev/null || { echo "error: 'step' CLI not found (smallstep/cli)"; exit 1; }
+[ -f "$FLEET_CA_ROOT" ] || { echo "error: fleet root not found at $FLEET_CA_ROOT (bootstrap the fleet CA first)"; exit 1; }
+[ -f "$STEP_PROVISIONER_PASSWORD_FILE" ] || { echo "error: provisioner password not found at $STEP_PROVISIONER_PASSWORD_FILE"; exit 1; }
+
+mkdir -p "$OUT"
+
+# The fleet root doubles as the agent-plane CLIENT CA (verifies host TPM certs).
+cp "$FLEET_CA_ROOT" "$OUT/fleet-ca.crt"
+
+# First SAN is the CN; every SAN (DNS name / IP) hosts might dial goes in --san.
+primary=${AGENT_SANS%%,*}
+san_args=()
+IFS=',' read -ra sans <<<"$AGENT_SANS"
+for s in "${sans[@]}"; do san_args+=(--san "$s"); done
+
+echo "==> issuing agent-plane server cert (CN=$primary, SANs=$AGENT_SANS)"
+step ca certificate "$primary" "$OUT/server.crt" "$OUT/server.key" \
+    --ca-url "$FLEET_CA_URL" \
+    --root "$FLEET_CA_ROOT" \
+    --provisioner "$STEP_PROVISIONER" \
+    --provisioner-password-file "$STEP_PROVISIONER_PASSWORD_FILE" \
+    --not-after "$CERT_NOT_AFTER" \
+    --force \
+    "${san_args[@]}"
+
+chmod 600 "$OUT/server.key"
+
+echo
+echo "done. staged in $OUT :"
+echo "  server.crt / server.key   -> FLEET_MGR_AGENT_CERT / _KEY"
+echo "  fleet-ca.crt              -> FLEET_MGR_AGENT_CLIENT_CA (verifies host TPM certs)"
+echo
+echo "next:"
+echo "  - admin UI cert  : Let's Encrypt DNS-01 -> ./pki/admin/{fullchain,privkey}.pem (DEPLOY.md)"
+echo "  - broker client  : ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager"
+echo "                     then: cp -r ../dot1x-bench/pki/broker ./pki/broker"