fleet-manager: checkpoint 1 — service skeleton + inventory store + admin API

First slice of the server-side fleet control plane (serving/fleet-manager/), the
backend for the admin SPA (monitor / authorise / lifecycle). See
docs/fleet-management-design.md + tpm-enrolment-design.md §5.

This checkpoint (stdlib-only):
- Inventory record (identity/binding/enrolled/version/health/usage/desired),
  keyed by TPM cert serial = hostnqn key, per the design's 'inventory record born
  at enrolment'. JSON-file Store (atomic writes, mutex) behind an interface so a
  DB swap is a drop-in.
- Admin plane: mTLS server verified by the DEDICATED admin CA (never the fleet CA,
  so a host cert can't reach admin) + a plaintext dev mode. JSON API:
  GET /api/hosts, GET /api/hosts/{serial}, PUT /api/hosts/{serial}/desired
  (desired-state audited to the admin client-cert CN).
- Dev seed (FLEET_MGR_SEED) so the SPA has data before real enrolment/agent flow.

Smoke-tested: list/get/desired-PUT (incl. version-drift + drain), 404s, atomic
persistence. go build + go vet + gofmt clean.

Agent gRPC plane, broker-fold-in authorise, InfluxDB metrics, and the themed SPA
follow in checkpoints 2-6.

serving/fleet-manager/go.mod

@@ -0,0 +1,15 @@
+// fleet-manager — server-side fleet control plane for the diskless kiosk fleet:
+// inventory, enrolment authorisation, lifecycle (desired-state) control, and the
+// metrics gateway that fronts InfluxDB. Backend for the admin SPA. See
+// docs/fleet-management-design.md and docs/tpm-enrolment-design.md §5.
+//
+// Unlike fleet-hostapi / fleet-enrol (baked into the reproducible verity image,
+// so stdlib-only), this is a SERVER-SIDE service that ships as its own container
+// on the mgmt network — external deps are acceptable here. They are added at the
+// build checkpoint that needs them:
+//   - google.golang.org/grpc + protobuf : the agent bidi stream (checkpoint 2)
+//   - github.com/influxdata/influxdb-client-go/v2 : metrics read/write (ckpt 2/4)
+// Checkpoint 1 (this commit) is stdlib-only.
+module fleet-manager
+
+go 1.22