Fleet monitoring: sysstat 28d + perfsnap/PSI/iotop timers + on-demand toolbox container (#826)

- monitoring/node-install.sh: idempotent per-node installer (sar HISTORY=28,
  three oneshot timers, per-node conf with qemu.slice/lxc cgroup globs)
- monitoring/collectors + systemd units: iotop-snap 15min, perfsnap 60s,
  psi-textfile 15s (now sources /etc/knelperf/perfsnap.conf; multi-glob)
- monitoring/toolbox: pct LXC (vmid 950, privileged, apparmor unconfined,
  stopped at rest) + knelperf-toolbox wrapper + Dockerfile variant
- monitoring/deploy-fleet.sh: workstation-side rollout driver
- piloted on pfv-tsys1: per-VM PSI gauges verified live

Redmine: https://projects.knownelement.com/issues/826

monitoring/deploy-fleet.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Deploy KNELPerf node monitoring (+ toolbox LXC) to PVE fleet nodes (#826).
+# Runs from the workstation / a tooling host — never on a node itself.
+#   deploy-fleet.sh [--toolbox] host [host...]
+# Prod nodes (tsys4/5/6/7) deploy ONLY after their GLPI CR exists.
+# Docs: https://community.turnsys.com/t/328
+set -euo pipefail
+here=$(cd "$(dirname "$0")/.." && pwd)
+WITH_TOOLBOX=0
+if [ "${1:-}" = --toolbox ]; then WITH_TOOLBOX=1; shift; fi
+[ $# -ge 1 ] || { echo "usage: $0 [--toolbox] host..." >&2; exit 1; }
+
+for host in "$@"; do
+  echo "=== $host ==="
+  timeout 30 ssh -o ConnectTimeout=8 "root@$host" 'mkdir -p /tmp/knelperf-install'
+  tar -C "$here" -cf - scheduler/collectors monitoring \
+    | timeout 120 ssh "root@$host" 'tar -C /tmp/knelperf-install -xf -'
+  timeout 120 ssh "root@$host" 'bash /tmp/knelperf-install/monitoring/node-install.sh'
+  if [ "$WITH_TOOLBOX" = 1 ]; then
+    timeout 600 ssh "root@$host" 'bash /tmp/knelperf-install/monitoring/toolbox/lxc-toolbox.sh --create'
+  fi
+  timeout 30 ssh "root@$host" 'rm -rf /tmp/knelperf-install'
+done
+echo "fleet deploy done."