Save in-progress keysat integration and StartOS 0.4 work

Snapshot of the working tree before cleanup. Captures:
- Keysat licensing: server/license.js, /api/license/* endpoints in
  server/index.js, activation modal in public/index.html, embedded
  Ed25519 issuer key (assets/issuer.pub).
- StartOS 0.4 expansion: setApiKey action, version files v0.1.1
  through v0.1.15, file-models/config.json.ts, manifest updates.
- Self-hosted registry server (startos-registry/).
- Build/deploy scripts (bin/bump-version.sh, bin/deploy.sh, vendored
  yt-dlp binary), .gitignore, .deploy.env.example.
- Recent design docs (KEYSAT_INTEGRATION.md, UPGRADE-DESIGN.md) —
  retained here so they remain recoverable when removed in the
  follow-up cleanup commit.

Makefile

@@ -1,2 +1,22 @@
 # overrides to s9pk.mk must precede the include statement
 include s9pk.mk
+
+# ── Deploy ─────────────────────────────────────────────────────────────────
+# `make deploy` — interactively bumps the version, builds the x86 .s9pk,
+# uploads it to FileBrowser, registers with the Start9 registry, and triggers
+# a registry re-index. Reads credentials from .deploy.env — copy
+# .deploy.env.example to .deploy.env and fill in your values.
+.PHONY: deploy redeploy bump
+deploy:
+	@bash bin/bump-version.sh
+	@$(MAKE) --no-print-directory x86
+	@bash bin/deploy.sh
+
+# `make redeploy` — push the existing .s9pk as-is. No version bump, no build.
+redeploy:
+	@bash bin/deploy.sh
+
+# `make bump` — interactively bump the version (create a new version file and
+# wire it into the version graph). No build, no deploy.
+bump:
+	@bash bin/bump-version.sh