P2.2-P2.9, P3.2-P3.10, P4.1-P4.3: Complete Phases 2, 3, and 4

11 work units built in parallel and merged:

Agent handlers (Phase 2):
- P2.2 Deploy: pull images, stop/remove/run containers, update registry
- P2.3 Lifecycle: stop/start/restart with desired_state tracking
- P2.4 Status: list (registry), live check (runtime), get status (drift+events)
- P2.5 Sync: receive desired state, reconcile unmanaged containers
- P2.6 File transfer: push/pull scoped to /srv/<service>/, path validation
- P2.7 Adopt: match <service>-* containers, derive component names
- P2.8 Monitor: continuous watch loop, drift/flap alerting, event pruning
- P2.9 Snapshot: VACUUM INTO database backup command

CLI commands (Phase 3):
- P3.2 Login, P3.3 Deploy, P3.4 Stop/Start/Restart
- P3.5 List/Ps/Status, P3.6 Sync, P3.7 Adopt
- P3.8 Service show/edit/export, P3.9 Push/Pull, P3.10 Node list/add/remove

Deployment artifacts (Phase 4):
- Systemd units (agent service + backup timer)
- Example configs (CLI + agent)
- Install script (idempotent)

All packages: build, vet, lint (0 issues), test (all pass).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/examples/mcp.toml

@@ -0,0 +1,56 @@
+# MCP CLI configuration
+#
+# Default location: ~/.config/mcp/mcp.toml
+# Override with: mcp --config /path/to/mcp.toml
+
+# ------------------------------------------------------------------
+# Service definitions
+# ------------------------------------------------------------------
+[services]
+# Directory containing service definition TOML files (one per service).
+# Each file declares the components, images, ports, and volumes for a
+# service. The CLI reads these files to push intent to agents.
+dir = "~/.config/mcp/services"
+
+# ------------------------------------------------------------------
+# MCIAS authentication
+# ------------------------------------------------------------------
+[mcias]
+# URL of the MCIAS server used for login and token validation.
+server_url = "https://mcias.svc.mcp.metacircular.net:8443"
+
+# Path to the CA certificate that signed the MCIAS TLS certificate.
+# If empty, the system trust store is used.
+ca_cert = "/usr/local/share/ca-certificates/metacircular-ca.crt"
+
+# Service name presented to MCIAS during authentication. This must
+# match a service registered in MCIAS.
+service_name = "mcp"
+
+# ------------------------------------------------------------------
+# Token storage
+# ------------------------------------------------------------------
+[auth]
+# Path where the CLI stores the MCIAS bearer token after login.
+# The file is created with 0600 permissions.
+token_path = "~/.config/mcp/token"
+
+# Optional: username for unattended (non-interactive) operation.
+# When set alongside password_file, "mcp login" uses these
+# credentials automatically instead of prompting.
+# username = "admin"
+
+# Optional: path to a file containing the password. The file should
+# be owned by the operator and have 0600 permissions.
+# password_file = "~/.config/mcp/password"
+
+# ------------------------------------------------------------------
+# Managed nodes
+# ------------------------------------------------------------------
+# Each [[nodes]] entry registers a node that the CLI can target.
+# The name must match the node_name in the agent's config. The
+# address is host:port on the overlay network.
+
+[[nodes]]
+name = "rift"
+address = "100.95.252.120:9444"