Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

server/systemd/podman-update.service

@@ -0,0 +1,22 @@
+[Unit]
+# Nightly image updates. Replaces watchtower, which recreated containers outside
+# their podman-compose pod and took gitea down for three days — see the header
+# of server/scripts/update-containers.
+Description=Pull new container images and restart changed services
+Documentation=https://git.gbrown.org/gib/Panama
+# Needs the network and the podman socket path to exist.
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+# %h rather than a literal home so the unit works for whichever user linked it.
+# The one assumption is the standard checkout path; a machine with PANAMA_PATH
+# somewhere else edits this line, and setup-server will say so when the script
+# is not where this points.
+ExecStart=%h/.local/share/Panama/server/scripts/update-containers
+# Pulling ~20 images over a slow registry can take a while; do not kill it early.
+TimeoutStartSec=3600
+# The script logs to ~/Server/logs/update-containers.log as well as the journal.
+StandardOutput=journal
+StandardError=journal

server/systemd/podman-update.timer

@@ -0,0 +1,16 @@
+[Unit]
+Description=Nightly container image updates at midnight
+Documentation=https://git.gbrown.org/gib/Panama
+
+[Timer]
+# Midnight local time.
+OnCalendar=*-*-* 00:00:00
+# If the machine was off at midnight, run once after it comes back rather than
+# skipping the day entirely.
+Persistent=true
+# Avoid every timer on the box firing at the same instant.
+RandomizedDelaySec=300
+
+[Install]
+# User timers need linger, which setup-server enables.
+WantedBy=timers.target