feat(node-agent): production ops kit — Windows service + WireGuard mesh

config:
- LoadEnvFile(): reads agent.env beside the exe (or $AGENT_ENV_FILE) before env,
  so the sc.exe service needs no per-service environment plumbing; real env wins

deploy/ (new):
- build-windows.ps1     cross-compile → dist\ + stage the deploy kit
- agent.env.example     fully documented config template
- install-service.ps1   register as auto-start Windows service (native sc.exe),
                        crash-restart 3×/5s, no NSSM dependency
- uninstall-service.ps1 stop + remove
- wireguard-node.conf.template + setup-wireguard.ps1  node dials out only, no
                        public IP / inbound rules; tunnel installed as boot service
- README.md             full control-plane + node walkthrough, ops table, troubleshooting

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/node-agent/deploy/uninstall-service.ps1

@@ -0,0 +1,32 @@
+<#
+.SYNOPSIS
+  Stop and remove the FlatRender Node Agent Windows service.
+.EXAMPLE
+  .\uninstall-service.ps1
+#>
+param(
+  [string]$ServiceName = "FlatRenderNodeAgent"
+)
+
+$ErrorActionPreference = "Stop"
+
+$principal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+  Write-Error "This script must be run as Administrator."
+  exit 1
+}
+
+$svc = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
+if (-not $svc) {
+  Write-Host "Service '$ServiceName' is not installed — nothing to do."
+  exit 0
+}
+
+if ($svc.Status -ne 'Stopped') {
+  Write-Host "Stopping '$ServiceName'..."
+  Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue
+  Start-Sleep -Seconds 2
+}
+
+& sc.exe delete $ServiceName | Out-Null
+Write-Host "✓ Service '$ServiceName' removed." -ForegroundColor Green