feat(P01): SLICE-08+09+10 — secret wiring, bats tests (121), e2e verification

SLICE-08 (devops-engineer): .env.example updated with Proxmox deployment
  vars (documented, sourced from ~/coreci/.env.secrets per D-026),
  PRAXIS_CLIENT_DIST for StaticFiles, PRAXIS_SCENARIO. config.json
  secrets.scopes already extended in SPECIFY (proxmox + voice scopes).
SLICE-09 (devops-engineer): 10 bats test files (G-106 fix: 10 not 9)
  covering all proxmox scripts — 121 tests, 114 pass + 7 skipped (e2e).
  Mocked curl/pct/ssh; no live cluster needed for unit tests.
SLICE-10 (devops-engineer): e2e-deploy.sh — sources secrets from both
  coreci + praxis .env.secrets, runs full deploy, verifies /health +
  client HTML serving. REQ-DEPLOY-15 covered.

All 6 grill binding decisions addressed:
  G-101 MUST: GITEA_TOKEN baked into snippet (stage-snippet.sh)
  G-102 MUST: PRAXIS_DB_PATH env read (db/store.py + db/migrate.py)
  G-103 FIX:  all 16 env vars in injection list (install-service.sh)
  G-104 FIX:  health-check timeout 600s (health-check.sh)
  G-105 FIX:  Dockerfile copy ordering (pyproject before source)
  G-106 FIX:  bats test count = 10

REQ-DEPLOY-12, 14, 15 covered. All 20 REQ-IDs now implemented.

---ci---
project: praxis
phase: 1
milestone: v0.2
status: execute
slice: 08-10
wave: 4
---/ci---

.env.example

@@ -1,6 +1,7 @@
-# Praxis v0.1 — Environment Configuration
-# Copy to `.env` and fill in real values. See docs/latency-report.md for key-provisioning status.
-# At v0.1 EXECUTE time, only GITEA_TOKEN is provisioned; voice-service keys are pending.
+# Praxis — Environment Configuration (v0.2)
+# Copy to `.env` and fill in real values.
+# Voice-service keys are in .ciagent/.env.secrets (not this file).
+# Proxmox deployment vars are sourced from ~/coreci/.ciagent/.env.secrets (D-026).
 
 # ─── Voice services ──────────────────────────────────────────────────────────
 # Deepgram Nova-3 ASR (D-013). Get from https://console.deepgram.com/
@@ -28,8 +29,11 @@ OLLAMA_DEBRIEF_MODEL=deepseek-v4-flash:cloud
 # ─── Server ───────────────────────────────────────────────────────────────────
 PRAXIS_HOST=0.0.0.0
 PRAXIS_PORT=8789
+# In Docker: /app/data/praxis.db (volume-mounted). Local dev: ./praxis.db
 PRAXIS_DB_PATH=./praxis.db
 PRAXIS_SCENARIOS_DIR=./scenarios
+# Client dist directory (for FastAPI StaticFiles serving, D-023)
+PRAXIS_CLIENT_DIST=client/dist
 
 # ─── Deepgram live options (D-013) ────────────────────────────────────────────
 DEEPGRAM_MODEL=nova-3
@@ -39,5 +43,18 @@ DEEPGRAM_REGION=na
 # ─── Cartesia voice (D-006 — one voice for role-play + mentor) ────────────────
 CARTESIA_VOICE_ID=a3536a36-1d18-4efb-a95a-7c44b7b5e384
 
+# ─── Proxmox LXC deployment (v0.2) ────────────────────────────────────────────
+# These are sourced from ~/coreci/.ciagent/.env.secrets (D-026 — same cluster).
+# Listed here for documentation; do NOT duplicate in .ciagent/.env.secrets.
+# PROXMOX_API_URL=https://proxmox:8006/api2/json
+# PROXMOX_API_TOKEN=root@pam!praxis-deploy=SECRET
+# PROXMOX_NODE=ns1003845
+# PROXMOX_STORAGE=local
+# PROXMOX_TEMPLATE_VOLID=local:vztmpl/debian-12-standard_12.2-1_amd64.tar.zst
+# PROXMOX_LXC_VMID=auto
+# PROXMOX_TLS_SKIP_VERIFY=true
+# PROXMOX_MEMORY_MB=4096
+
 # ─── CI/Gitea (operational — not voice) ───────────────────────────────────────
-# GITEA_TOKEN is provisioned in .ciagent/.env.secrets (not this file).
+# GITEA_TOKEN is provisioned in .ciagent/.env.secrets (not this file).
+# PRAXIS_VERSION (git ref to deploy, default: main)