fleet-manager: run the CI-built image (FLEET_MANAGER_VERSION), keep local build

Point the compose service at the registry image the new CI workflow pushes
(git.bitasylum.org/audiobuzz/fleet-manager:${FLEET_MANAGER_VERSION:-latest}) so
mgmt hosts `docker compose pull` instead of building at deploy time — matching
dnsmasq/spdk/kiosk. `build: .` stays for local dev. Add FLEET_MANAGER_VERSION to
.env.example.

serving/fleet-manager/.env.example

@@ -59,6 +59,9 @@ INFLUX_ADMIN_PASSWORD=changeme-influx-admin-password
 INFLUX_RETENTION=90d
 
 # --- misc ----------------------------------------------------------------------
+# CI image tag to run (from .gitea/workflows/fleet-manager-image.yaml): a release
+# semver, main-<sha7>, or a <branch>-<sha7> dev build. Defaults to :latest.
+FLEET_MANAGER_VERSION=latest
 FLEET_MGR_SESSION_TTL_MIN=720
 # Must match the enrol-broker's HOSTNQN_BASE.
 HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host-

serving/fleet-manager/docker-compose.yml

@@ -56,9 +56,13 @@ services:
       retries: 5
 
   # --- the control plane + embedded SPA --------------------------------------
+  # CI builds + pushes this image (.gitea/workflows/fleet-manager-image.yaml);
+  # `docker compose pull` fetches it. `build: .` stays so local dev can still
+  # `docker compose build fleet-manager`. Pin FLEET_MANAGER_VERSION in .env to a
+  # CI tag (e.g. main-<sha7>); defaults to :latest.
   fleet-manager:
+    image: "git.bitasylum.org/audiobuzz/fleet-manager:${FLEET_MANAGER_VERSION:-latest}"
     build: .
-    image: fleet-manager:local
     restart: unless-stopped
     # Host networking: reach the broker on 127.0.0.1:9443 + InfluxDB on
     # 127.0.0.1:8086, and bind the agent gRPC listener on a routable mgmt addr.