web: shared MCMS cache + systemd/clone-to-run deploy + NPM docs

Caching (reduce MCMS API load with multiple operators):
- web/cache.js: in-memory TTL cache with single-flight, keyed by MCMS host.
  Concurrent identical bulk reads collapse into ONE upstream fetch; everyone
  on the same MCMS shares the snapshot.
- Wired into the bulk reads only (ONU/OLT config+state lists, controllers,
  firmware). Per-ONU read-modify-write and the FEC pre-flight stay live.
- Writes (delete / per-ONU + bulk upgrade / flood change / firmware upload)
  invalidate the affected datasets for that host, so changes show on the
  next load instead of waiting out the TTL.
- PFW_CACHE_TTL_SECONDS (default 60, 0 disables). Authenticated
  _cacheStats / _cacheClear endpoints for ops.

Deploy (Debian 13 LXC, clone-to-run) in web/deploy/:
- pon-fleet-web.service (runs as unprivileged ponfw, hardened, repo
  read-only, no disk writes), pon-fleet-web.env.example, update.sh
  (git pull + npm install --omit=dev + restart; uses install not ci since
  package-lock.json is gitignored).
- README: full LXC setup, Nginx Proxy Manager proxy-host + access-list
  notes. Streams already send X-Accel-Buffering: no so NPM/nginx don't
  buffer the NDJSON progress.

Verified: node --check; cache unit-tested (single-flight, TTL hit/expiry,
fresh, invalidate, key isolation, disable — 9/9); server boots and reports
the cache TTL; _cacheStats gated to logged-in sessions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/deploy/update.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Update the PON Fleet web server in place: pull the repo, reinstall runtime
+# deps (tough-cookie only — Electron is a devDep and is skipped), restart.
+# Run as root (or via sudo) on the LXC. Override the path with PONFW_DIR.
+set -euo pipefail
+
+REPO="${PONFW_DIR:-/opt/ponfw}"
+SERVICE="pon-fleet-web"
+
+echo "==> Updating $REPO"
+cd "$REPO"
+git pull --ff-only
+
+echo "==> Installing runtime dependencies (omit dev / Electron)"
+# `npm install` (not `npm ci`) because this repo gitignores package-lock.json.
+npm install --omit=dev --no-audit --no-fund
+
+echo "==> Restarting $SERVICE"
+systemctl restart "$SERVICE"
+sleep 1
+systemctl --no-pager --lines=8 status "$SERVICE" || true
+echo "==> Done."