Ship v0.1.1–v0.1.5: first-live-run fixes and dashboard viewer

- v0.1.1: config persistence — FileHelper paths made absolute
  (/media/startos/volumes/main/...); relative paths resolved into the JS
  runtime's ephemeral cwd so action saves never reached /data
- v0.1.2: preJobStopContainers (Configure Grading) — docker-stop resident
  vLLM containers on the head Spark at job start, no auto-restart
- v0.1.3: preflight auth (LiteLLM master_key gates /models),
  poll-until-loaded, crash fast-fail (restarting counts as dead)
- v0.1.4: HF_HUB_OFFLINE/TRANSFORMERS_OFFLINE in airgapped serving
  (--internal network has no DNS); grader _post timeout 600→1800s for
  ~3.6 tok/s GB10 generation
- v0.1.5: dashboard viewer survives the periodic background refresh;
  download buttons for deck reports, deck JSON, and SCORECARD.md
- .gitignore: .startos/ build workspace, start-technologies/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

startos/file-models/secrets.ts

@@ -5,9 +5,13 @@ import { FileHelper } from '@start9labs/start-sdk'
  * `main` volume. Kept out of config.json so it is never returned in plaintext
  * config reads. The container copies it to a 600 path at runtime.
  *
- * Volume path './ssh/id_spark' -> /data/ssh/id_spark inside the container.
+ * Volume path (absolute — a relative path would resolve against the JS
+ * runtime's ephemeral cwd, not the volume) -> /data/ssh/id_spark inside the
+ * orchestrator container.
  */
-export const sshKeyFile = FileHelper.string('./ssh/id_spark')
+export const sshKeyFile = FileHelper.string(
+  '/media/startos/volumes/main/ssh/id_spark',
+)
 
 /**
  * Optional Hugging Face token (for gated/private model pulls on the Sparks).
@@ -15,7 +19,7 @@ export const sshKeyFile = FileHelper.string('./ssh/id_spark')
  * network mode models are served from a pre-pulled cache, so this is only used
  * the first time you warm a model (or in local_services mode).
  *
- * Volume path './secrets/hf_token' -> /data/secrets/hf_token.
+ * Volume path (absolute, see above) -> /data/secrets/hf_token.
  *
  * NOTE: Boardroom Map has NO frontier/cloud key. There is deliberately no Anthropic
  * key and no Gitea token — the whole point is that confidential documents and