fleet-manager: add Makefile that sets COMPOSE_ENV_FILES for you

`make up` / `logs` / `restart` / `pull` / `build` / `config` / `register-admin`
/ `backup` — each exports COMPOSE_ENV_FILES=defaults.env,.env so plain `make ...`
layers the committed defaults under .env with no manual export or --env-file.
Guards on .env existing (COMPOSE_ENV_FILES requires it) with a clear message.
`make help` lists targets. DEPLOY §1 points at it.

serving/fleet-manager/DEPLOY.md

@@ -49,6 +49,10 @@ running compose. Per-command alternative: `docker compose --env-file defaults.en
 --env-file .env …`. The Influx token is handed to **both** InfluxDB (its init
 admin token) and the manager, so one value wires them.
 
+Or skip the export entirely and use the **Makefile**, which sets
+`COMPOSE_ENV_FILES` for you: `make up` / `make logs SERVICE=fleet-manager` /
+`make register-admin NAME=you` / `make config` (`make help` lists targets).
+
 ## 2. PKI
 
 Three certs, three trust roots — do not conflate them (see README "two planes"):

serving/fleet-manager/Makefile

@@ -0,0 +1,56 @@
+# Makefile — convenience wrapper for the fleet-manager stack.
+#
+# Sets COMPOSE_ENV_FILES so `make up` / `make logs` / etc. layer the committed
+# defaults.env UNDER your .env overrides automatically — no need to export it or
+# pass --env-file. (Plain `docker compose …` still works if you export
+# COMPOSE_ENV_FILES=defaults.env,.env yourself.) Run from serving/fleet-manager/.
+
+export COMPOSE_ENV_FILES := defaults.env,.env
+
+COMPOSE := docker compose
+SERVICE ?=
+NAME    ?=
+
+.DEFAULT_GOAL := help
+
+.PHONY: help up down restart pull build logs ps config register-admin backup
+
+help: ## Show this help
+	@grep -hE '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) \
+	  | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-16s\033[0m %s\n", $$1, $$2}'
+
+# .env must exist because COMPOSE_ENV_FILES lists it — guard with a clear message.
+.env:
+	@echo "ERROR: .env not found — create it with your secrets/overrides (DEPLOY.md §1)." >&2
+	@exit 1
+
+up: .env ## Start the stack (influxdb + fleet-manager + traefik)
+	$(COMPOSE) up -d
+
+down: .env ## Stop + remove the stack
+	$(COMPOSE) down
+
+restart: .env ## Recreate a service (SERVICE=fleet-manager) or all
+	$(COMPOSE) up -d --force-recreate $(SERVICE)
+
+pull: .env ## Pull the CI-built images
+	$(COMPOSE) pull
+
+build: .env ## Build the fleet-manager image locally
+	$(COMPOSE) build fleet-manager
+
+logs: .env ## Follow logs (SERVICE=fleet-manager for one)
+	$(COMPOSE) logs -f $(SERVICE)
+
+ps: .env ## Show container status
+	$(COMPOSE) ps
+
+config: .env ## Print the resolved (layered) compose config
+	$(COMPOSE) config
+
+register-admin: .env ## Mint a passkey enrol link (NAME=you)
+	@test -n "$(NAME)" || { echo "usage: make register-admin NAME=<you>" >&2; exit 1; }
+	$(COMPOSE) run --rm fleet-manager register-admin "$(NAME)"
+
+backup: ## Snapshot the durable volumes (backup.sh)
+	./backup.sh