web: shared MCMS cache + systemd/clone-to-run deploy + NPM docs

Caching (reduce MCMS API load with multiple operators):
- web/cache.js: in-memory TTL cache with single-flight, keyed by MCMS host.
  Concurrent identical bulk reads collapse into ONE upstream fetch; everyone
  on the same MCMS shares the snapshot.
- Wired into the bulk reads only (ONU/OLT config+state lists, controllers,
  firmware). Per-ONU read-modify-write and the FEC pre-flight stay live.
- Writes (delete / per-ONU + bulk upgrade / flood change / firmware upload)
  invalidate the affected datasets for that host, so changes show on the
  next load instead of waiting out the TTL.
- PFW_CACHE_TTL_SECONDS (default 60, 0 disables). Authenticated
  _cacheStats / _cacheClear endpoints for ops.

Deploy (Debian 13 LXC, clone-to-run) in web/deploy/:
- pon-fleet-web.service (runs as unprivileged ponfw, hardened, repo
  read-only, no disk writes), pon-fleet-web.env.example, update.sh
  (git pull + npm install --omit=dev + restart; uses install not ci since
  package-lock.json is gitignored).
- README: full LXC setup, Nginx Proxy Manager proxy-host + access-list
  notes. Streams already send X-Accel-Buffering: no so NPM/nginx don't
  buffer the NDJSON progress.

Verified: node --check; cache unit-tested (single-flight, TTL hit/expiry,
fresh, invalidate, key isolation, disable — 9/9); server boots and reports
the cache TTL; _cacheStats gated to logged-in sessions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -796,9 +796,22 @@ Consequences for editing:
   browser session (cookie `pfw_sid`), vs. the Electron app's single global
   `client`. CSV writes become browser downloads; file dialogs become
   `<input type=file>`. Dashboard aggregation is shared via `src/dashboard.js`.
+- **Shared upstream cache** (`web/cache.js`). Heavy bulk *reads* (ONU/OLT
+  config+state lists, controllers, firmware) go through a TTL cache with
+  single-flight, keyed by MCMS host, so concurrent operators collapse into
+  one upstream fetch (`PFW_CACHE_TTL_SECONDS`, default 60). Per-ONU
+  read-modify-write fetches and the FEC pre-flight stay **uncached** (must be
+  live). Writes call `invalidate(session, [...])` for the affected datasets.
+  This cache is web-only; the single-user Electron app doesn't need it.
+- **Deploy** lives in `web/deploy/` (systemd unit + env template +
+  `update.sh`); Debian-13-LXC clone-to-run steps and the Nginx Proxy Manager
+  setup are in `web/README.md`. Note streams send `X-Accel-Buffering: no` so
+  nginx/NPM don't buffer the NDJSON progress.
 
 The web app must stay a subdirectory of this repo — it `require`s `../src/*`
-and borrows `../node_modules` (`tough-cookie`); no separate install.
+and borrows `../node_modules` (`tough-cookie`); no separate install. Deploy
+uses `npm install --omit=dev` (not `npm ci` — `package-lock.json` is
+gitignored) which pulls `tough-cookie` and skips the Electron devDep.
 
 ---