feat(node-agent): production ops kit — Windows service + WireGuard mesh

config:
- LoadEnvFile(): reads agent.env beside the exe (or $AGENT_ENV_FILE) before env,
  so the sc.exe service needs no per-service environment plumbing; real env wins

deploy/ (new):
- build-windows.ps1     cross-compile → dist\ + stage the deploy kit
- agent.env.example     fully documented config template
- install-service.ps1   register as auto-start Windows service (native sc.exe),
                        crash-restart 3×/5s, no NSSM dependency
- uninstall-service.ps1 stop + remove
- wireguard-node.conf.template + setup-wireguard.ps1  node dials out only, no
                        public IP / inbound rules; tunnel installed as boot service
- README.md             full control-plane + node walkthrough, ops table, troubleshooting

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/node-agent/deploy/agent.env.example

@@ -0,0 +1,35 @@
+# FlatRender Node Agent configuration.
+# Copy to `agent.env` and place next to flatrender-node-agent.exe.
+# The agent reads this file on startup (env vars still override any line here).
+
+# ── Required ─────────────────────────────────────────────────────────────────
+# UUID of this node, pre-created in render.render_nodes (admin → /admin/nodes).
+NODE_ID=00000000-0000-0000-0000-000000000000
+
+# ── Connectivity ─────────────────────────────────────────────────────────────
+# Gateway base URL. Over the WireGuard mesh this is the control-plane's WG IP.
+# Example (WG): http://10.66.0.1:8088   Local dev: http://localhost:8088
+ORCHESTRATOR_URL=http://10.66.0.1:8088
+
+# Shared secret for the X-Node-Signature header. MUST match NODE_HMAC_SECRET
+# in the render-svc environment (.env.v2). Change from the default!
+NODE_HMAC_SECRET=change-me-to-a-long-random-secret
+
+# Region label — the orchestrator routes region-preferred jobs here.
+NODE_REGION=iran-tehran-1
+
+# ── After Effects ────────────────────────────────────────────────────────────
+# Full path to aerender.exe. Leave empty to run the MOCK renderer (no AE needed).
+AE_PATH=C:\Program Files\Adobe\Adobe After Effects 2024\Support Files\aerender.exe
+AE_VERSION=2024
+
+# ── Local paths / tuning ─────────────────────────────────────────────────────
+# Scratch dir for downloaded .aep bundles + render output. Use a fast NVMe drive.
+WORK_DIR=C:\flatrender\work
+
+# Health endpoint port (the orchestrator and you can curl http://<node>:7777/health).
+LISTEN_PORT=7777
+
+# Loop cadences (seconds).
+HEARTBEAT_INTERVAL_SEC=5
+POLL_INTERVAL_SEC=3