feat: deploy zopu single-node production

deploy/zopu-runtime/systemd/zopu-agent.service

@@ -10,10 +10,11 @@ Group=__SERVICE_USER__
 WorkingDirectory=__INSTALL_DIR__/packages/agents
 
 EnvironmentFile=__INSTALL_DIR__/.env
+Environment=PORT=3583
 
-# Flue build output: packages/agents/dist/server.mjs
-# Listens on PORT (default 3583 per .env.template).
-ExecStart=/usr/local/bin/bun dist/server.mjs
+# Flue's Node target requires Node built-ins such as node:sqlite.
+# Listens on the service-pinned port 3583.
+ExecStart=/usr/bin/node dist/server.mjs
 
 Restart=always
 RestartSec=10

deploy/zopu-runtime/systemd/zopu-daemon.service

@@ -10,11 +10,13 @@ Group=__SERVICE_USER__
 WorkingDirectory=__INSTALL_DIR__
 
 EnvironmentFile=__INSTALL_DIR__/.env
+Environment=HOME=/var/lib/zopu
+StateDirectory=zopu
 
 # RivetKit in-process engine: envoy mode (serverful).
-# registry.start() boots the native Rust sidecar and actor envoy.
-# RIVET_ENDPOINT defaults to http://localhost:6420 inside the daemon process.
-ExecStart=__INSTALL_DIR__/apps/daemon/dist/code-daemon
+# Run the Bun source entrypoint so AgentOS software assets retain their real
+# node_modules paths; Bun compiled executables do not embed .aospkg files.
+ExecStart=/usr/local/bin/bun --env-file=__INSTALL_DIR__/.env apps/daemon/src/index.ts
 
 Restart=always
 RestartSec=10

deploy/zopu-runtime/systemd/zopu-web.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Zopu Web
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=__SERVICE_USER__
+Group=__SERVICE_USER__
+WorkingDirectory=__INSTALL_DIR__/apps/web
+EnvironmentFile=__INSTALL_DIR__/.env
+Environment=HOST=127.0.0.1
+Environment=PORT=13100
+ExecStart=/usr/local/bin/bun run start
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=zopu-web
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target