fleet-manager: layer config as defaults.env (committed) + .env (overrides)

Rename .env.example -> defaults.env and make it the committed defaults layer.
Compose reads defaults.env then .env (later wins) via COMPOSE_ENV_FILES, feeding
BOTH container env and ${...} interpolation — so a changed default here reaches
every run without re-copying, and .env shrinks to just overrides + secrets.

No compose service restructure: the existing interpolated environment: blocks
already build the container env; the layering just supplies their values from two
files. (env_file: directive alone wouldn't work — it doesn't feed the image-tag /
cross-service Influx / ACME_EMAIL interpolation this compose relies on.)

Docs (DEPLOY §1, compose header, README) updated: export
COMPOSE_ENV_FILES=defaults.env,.env, keep only secrets/overrides in .env.

serving/fleet-manager/README.md

@@ -139,11 +139,13 @@ inventory for offline delivery. Metrics writing is behind a `MetricsSink`
 ## Deploy
 
 Full bring-up (PKI, Let's Encrypt DNS-01, `register-admin`, compose) is in
-[`DEPLOY.md`](DEPLOY.md). In short: `cp .env.example .env` → `./server-pki.sh` +
+[`DEPLOY.md`](DEPLOY.md). Config is layered: **`defaults.env`** (committed) +
+**`.env`** (overrides/secrets), via `COMPOSE_ENV_FILES=defaults.env,.env`. In
+short: set that + write your secrets to `.env` → `./server-pki.sh` +
 `../enrol-broker/admin-pki.sh … fleet-manager` → `docker compose up -d influxdb`
 → `docker compose run --rm fleet-manager register-admin <you>` → `docker compose
-up -d fleet-manager`. InfluxDB is private (published to loopback only); the
-manager uses host networking to reach the loopback broker + bind a routable
+up -d fleet-manager traefik`. InfluxDB is private (published to loopback only);
+the manager uses host networking to reach the loopback broker + bind a routable
 agent listener.
 
 ## Dev run
@@ -184,7 +186,7 @@ curl -s localhost:9500/api/hosts | jq '.hosts[] | {name:.identity.starship_name,
   (index + assets + API through the SPA origin).
 - **Checkpoint 7 (done):** deployment — three-stage `Dockerfile` (npm→dist→
   `go build -tags embedspa`→distroless), `docker-compose.yml` (private InfluxDB +
-  host-networked manager), `.env.example`, `server-pki.sh` (agent-plane fleet-CA
+  host-networked manager), `defaults.env`, `server-pki.sh` (agent-plane fleet-CA
   server cert), and [`DEPLOY.md`](DEPLOY.md) (PKI, LE DNS-01, `register-admin`
   bootstrap). Design docs updated (manager marked built; resolved transport/auth/
   metrics forks; per-host-versioning gap recorded).