v0.3.1 — region-aware deploys and a preflight doctor

Bug fixes and cleanup on top of v0.3.0's OpenTofu migration. Two changes need action
before your next deploy — see Upgrading below.

Highlights

• app.region now actually drives the deployment (#70). Every .tf file ignored it,
  so infrastructure landed in us-west-2 no matter what the config said. The provider now
  reads app.region, and the allocator boots from stock Ubuntu 24.04 resolved per-region
  via SSM (Docker is installed by user_data.sh) instead of a hardcoded AMI — so a new
  region no longer means copying a custom image.
• scripts/doctor.sh (#67): a re-runnable preflight that re-checks everything
  setup.sh created and reproduces every hard-fail in the deploy workflow — state bucket,
  IAM role, OIDC provider, GitHub secrets, and the config against the allocator's strict
  schema — so a problem surfaces locally in seconds instead of three minutes into a
  workflow run. Also documents the admin UI the allocator has always shipped.
• Cleanup tooling points at the real resource names (#68). cleanup-orphaned-resources.sh
  was searching for names OpenTofu never creates, so it reported a clean account while
  resources kept billing.
• Scripts run from any directory (#69), and the README is split into an entry point plus
  reference pages under docs/ (#66, #71).
• HTTP deployments disable H.264 streaming — now said out loud in the docs and by the
  doctor (#72), instead of being discovered after setup.

Upgrading from v0.3.0

1. Trim your config.yaml's db: block to password: only (#64, #65). The allocator's
   schema accepts no other db key, and the schema is strict — dbname, user, host,
   port and table_name now make the config fail validation outright. Postgres runs
   inside the allocator container; none of them was ever configurable.
2. Check app.region before applying. If your config names a region other than
   us-west-2, this release will build there — your existing us-west-2 resources are not
   moved and will keep billing. Destroy the old deployment first, or set app.region to
   us-west-2 to stay put.
3. The deploy role needs ssm:GetParameter for the AMI lookup. scripts/setup.sh
   attaches it; a hand-rolled role from docs/SETUP.md needs it added or tofu plan fails.
4. dev uses S3 state now, not local state (#63). Set bucket_name in a dev config to a
   real bucket you own — scripts/setup.sh creates one. dev stays local-only and is not
   exposed in the deploy workflow.

An existing allocator keeps the AMI it booted with (ignore_changes = [ami]), so Canonical
publishing a new image will not silently replace a running instance. Note that editing
config.yaml still replaces the allocator EC2 instance.

What's Changed

• docs: record that Path B must never require the LabLink CLI by @7174Andy in #62
• fix: resync configs with the allocator's db schema (main is currently invalid) by @7174Andy in #64
• fix: dev.example.yaml fails validation on main, and restore the correct db docs by @7174Andy in #65
• fix: give dev a real S3 state key instead of unreachable local state by @7174Andy in #63
• docs: restructure README into an entry point plus reference pages, and drop the dead monitoring surface by @7174Andy in #66
• refactor: make every script runnable from any directory by @7174Andy in #69
• fix: point the cleanup tooling at the resource names OpenTofu actually creates by @7174Andy in #68
• feat: add a re-runnable preflight doctor, and document the admin UI Path B already has by @7174Andy in #67
• chore: move standalone docs into docs/, drop unused .dockerignore, add /pr skill by @7174Andy in #71
• fix: make app.region actually drive the deployment, and boot the allocator from stock Ubuntu by @7174Andy in #70
• docs+doctor: say that an HTTP deployment disables H.264 streaming by @7174Andy in #72

Full Changelog: v0.3.0...v0.3.1