Add the deployment path: agent systemd unit and container image

The README referenced `deploy/install-agent.sh` and a `Containerfile` that
did not exist, so a fresh clone had no way to actually run this anywhere.

* agent: `--token-file` (and AGENT_TOKEN_FILE). The token guards hostname,
  mounts, disk and GPU models and process names, and argv is world-readable
  through `ps`, so a file has to win over the flag. Missing or empty token
  files are fatal — falling back to "no token" would expose the host.
* deploy/install-agent.sh: creates a system user, generates the token once
  (re-runs reuse it, --rotate-token for a new one), stores it 0600
  root-owned, and runs the agent under ProtectSystem=strict with no
  capabilities; --status and --uninstall included.
* Containerfile: two-stage, uv.lock resolved in the builder and slim Python
  in the runtime. Verified with podman — the image serves /api/health as an
  unprivileged user and writes its history under /var/lib/dashboards.
  UV_PROJECT_ENVIRONMENT and --no-editable are what make the venv survive
  being copied into the runtime stage.
* .containerignore keeps .git, .venv, data/ and .env out of the build
  context.

258 tests, 94% coverage; ruff and pyright clean.

LLM-Generated: true

Containerfile

@@ -0,0 +1,52 @@
+# Homelab dashboards — one image, three dashboards, one port.
+#
+#   podman build -t dashboards .
+#   podman run --rm -p 8090:8090 --env-file dashboards.env \
+#       -v dashboards-data:/var/lib/dashboards dashboards
+#
+# Two stages: the builder resolves `uv.lock` (exactly the versions the tests ran against),
+# the runtime stage is a plain slim Python with only the installed venv in it. No build
+# toolchain, no source, no dev dependencies in the final image.
+
+FROM ghcr.io/astral-sh/uv:python3.14-bookworm-slim AS builder
+WORKDIR /app
+# The venv is built at the path it will run from: a venv moved out of place has shebangs and
+# a `bin/python` symlink pointing at wherever it was built, which fails at exec time with a
+# confusing "missing dynamic library?".
+ENV UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never UV_PROJECT_ENVIRONMENT=/opt/venv
+# manifest first: a source-only change must not re-resolve the dependency graph
+COPY pyproject.toml uv.lock README.md ./
+RUN uv sync --frozen --no-dev --no-install-project
+COPY src ./src
+# --no-editable matters: uv installs the project editable by default, which leaves a .pth
+# pointing at /app/src — a path that only exists in the builder, and the app then dies at
+# import time with "No module named dashboards".
+RUN uv sync --frozen --no-editable
+
+FROM python:3.14-slim
+# no image.source label: the origin is set once this repo has one
+LABEL org.opencontainers.image.title="homelab dashboards" \
+      org.opencontainers.image.description="System, LLM engine and UPS battery dashboards on one domain"
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH=/opt/venv/bin:$PATH \
+    DASH_HOST=0.0.0.0 \
+    DASH_PORT=8090 \
+    DASH_DB=/var/lib/dashboards/dashboards.sqlite3
+
+RUN useradd --system --uid 10001 --home-dir /var/lib/dashboards --create-home dashboards
+COPY --from=builder /opt/venv /opt/venv
+# the host agent ships in the same image so one container can monitor the box it runs on
+COPY agent/host_agent.py /opt/dashboards/agent/host_agent.py
+
+VOLUME /var/lib/dashboards
+EXPOSE 8090
+USER dashboards
+
+# /api/health answers "empty" (200) with no sources configured, so a container that starts
+# before its env file is right still passes the probe instead of crash-looping.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+    CMD ["python", "-c", "import sys,urllib.request; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8090/api/health', timeout=4).status == 200 else 1)"]
+
+CMD ["dashboards"]