observability: give Dankserver its node-exporter back as a Quadlet

Dankserver's node-exporter has been dead since a reboot: `podman ps -a` showed
it `Exited (143)` and Prometheus' `node-dankserver` job has been scraping
nothing. It ran only from `dankserver/compose.yaml`, which is the failure mode
this repository's boot-persistence rule exists for (rootless Podman does not
restart bare containers after the stop that shutdown performs), and the compose
form bound the wildcard address — the unauthenticated-metrics-API-on-every-
interface posture already removed on Dankclaw.

  - dankserver/observability/quadlet/node-exporter.container — mirrors the
    Dankclaw unit, listening on exactly 127.0.0.1:9100 (host-local probes) and
    192.168.0.235:9100 (Prometheus on Dankclaw), with Restart=always and
    WantedBy=default.target.
  - the compose service is deleted: one owner per container name.
  - deploy_observability now installs from "$TARGET/observability/quadlet"; it
    hardcoded the Dankclaw path, so a Dankserver unit could not be installed by
    the shared dispatcher at all.
  - planner: "node-exporter" joins the Dankserver service set, with a path rule
    for dankserver/observability/**; the dispatcher's allowlist gains
    dankserver:node-exporter.

Seams cover the silent halves: both listen addresses present and the wildcard
absent, the compose service gone, the allowlist entry present, and the planner
mapping the path to the service.

scripts/deploy-plan.py

@@ -108,6 +108,7 @@ DANKSERVER_SERVICES = {
     "lidarr",
     "readarr",
     "frank-medium",
+    "node-exporter",
 }
 
 # FrankBook-Pro runs the *arr stack + qBittorrent inside a podman machine on
@@ -356,6 +357,16 @@ def services_for_path(path: str, target: str) -> set[str]:
                 "frank-medium": {"frank-medium"},
             }
             _add(services, *quadlet_services.get(parts[1], set()))
+        if len(parts) >= 2 and parts[1] == "observability":
+            # Dankserver's node-exporter became a Quadlet unit on 2026-09-16
+            # (serverAppConfigs-docs/Infrastructure/Observability.md): its
+            # compose service died at a reboot and stayed dead, so Prometheus'
+            # node-dankserver job had nothing to scrape.
+            if len(parts) >= 4 and parts[2] == "quadlet":
+                name = parts[3].removesuffix(".container")
+                if name == "node-exporter":
+                    _add(services, "node-exporter")
+            return services
         if len(parts) >= 2 and parts[1] == "frank-medium":
             # The vllm-radiance runtime since 2026-09-15: the quadlet file
             # above, plus the entrypoint and healthcheck it mounts straight

scripts/deploy-remote.sh

@@ -95,7 +95,7 @@ service_is_allowed() {
         dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:plex|dankserver:tautulli|\
         dankserver:prowlarr|dankserver:qbittorrent|dankserver:radarr|\
         dankserver:sonarr|dankserver:lidarr|dankserver:readarr|\
-        dankserver:frank-medium|\
+        dankserver:frank-medium|dankserver:node-exporter|\
         frankbook-pro:gluetun|frankbook-pro:qbittorrent|frankbook-pro:prowlarr|\
         frankbook-pro:radarr|frankbook-pro:sonarr|frankbook-pro:lidarr|\
         frankbook-pro:readarr)
@@ -425,6 +425,10 @@ seed_grafana_env() {
 # compose services published on 0.0.0.0 and none of them authenticates.
 deploy_observability() {
     local service="$1"
+    # Observability units live under <target>/observability/quadlet: Dankclaw
+    # has five, Dankserver one (node-exporter, since 2026-09-16). The config
+    # copies below are Dankclaw-owned state and run only there.
+    local unit_dir="$TARGET/observability/quadlet"
     case "$service" in
         prometheus)
             copy_prometheus_config
@@ -448,7 +452,7 @@ deploy_observability() {
             return 2
             ;;
     esac
-    install_quadlet observability dankclaw/observability/quadlet "$service"
+    install_quadlet observability "$unit_dir" "$service"
     systemctl --user restart "$service.service"
     case "$service" in
         prometheus) wait_for_health prometheus http://127.0.0.1:9090/-/healthy 60 ;;