Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

bin/panama

@@ -103,6 +103,8 @@ ${BOLD}Commands:${RESET}
               install.
   ${GREEN}app${RESET}         Build and install an application that neither dnf nor
               Flathub carries. With no name, lists what is available.
+  ${GREEN}server${RESET}      The compose services a server machine runs: list, enable,
+              disable, status, relink. See 'panama server help'.
   ${GREEN}help${RESET}        Show this help (also -h, --help).
 
 ${BOLD}Options:${RESET}
@@ -892,6 +894,7 @@ main() {
     migrate)       shift; cmd_migrate "$@" ;;
     app)           shift; cmd_app "$@" ;;
     apps)          shift; cmd_apps "$@" ;;
+    server)        shift; exec "$PANAMA_DIR/bin/panama-server" "$@" ;;
     help|-h|--help|"") usage ;;
     --version)     printf '%s %s\n' "$PROGRAM" "$VERSION" ;;
     *)