Add user-owned VPS deployment path

[unix2dos]

Scope

• Add a single-host VPS deployment path using an existing SSH alias, local Docker build, image transfer, and Docker Compose with Caddy HTTPS.
• Reuse Carry operation records for publish, reconciliation, logs, source rebinding, non-secret environment updates, and image-only rollback.
• Update the product direction and record the first Loop → DMIT acceptance evidence.

Verification

• go test -race ./cmd/carry, go vet ./cmd/carry, node --check cmd/carry/web/app.js passed.
• Real DMIT publish, HTTPS health, anonymous Loop model/tool run, persistent-volume readback, and image rollback/restore passed; see validation/VPS-RESULTS.md for scope and limits.

Boundaries

• One Carry-managed app per VPS in this preview. Databases, object storage, multi-app proxy routing, and full-server recovery remain outside this change.
• The released Alpha installer still covers existing Vercel/Railway applications; this branch is the source preview.