feat(device-plane): add canonical Device Manager runtime

infra/synology/Caddyfile.http

@@ -87,6 +87,16 @@ http://hub.nodedc.ru {
 	}
 }
 
+http://device.nodedc.ru {
+	reverse_proxy device-manager:18122 {
+		header_up Host device.nodedc.ru
+		header_up X-Forwarded-Host device.nodedc.ru
+		header_up X-Forwarded-Proto https
+		header_up X-Forwarded-Port 443
+		header_up X-Forwarded-For {remote_host}
+	}
+}
+
 http://ops.nodedc.ru {
 	reverse_proxy {$SYNOLOGY_TASK_MANAGER_UPSTREAM} {
 		header_up Host ops.nodedc.ru

infra/synology/docker-compose.platform-http.yml

@@ -46,11 +46,18 @@ services:
       AUTHENTIK_BASE_URL: http://nodedc-platform-authentik-server:9000
       NODEDC_NOTIFICATION_CORE_URL: http://notification-core:5185
       NODEDC_AI_WORKSPACE_ASSISTANT_URL: http://ai-workspace-assistant:18082
+      NODEDC_DEVICE_CORE_INTERNAL_TOKEN_FILE: /run/nodedc-secrets/device-core-internal-token
     expose:
       - "5173"
     volumes:
       - ../launcher/server-storage:/app/server/storage
       - ../launcher/uploads:/app/server/storage/uploads
+      - type: bind
+        source: /volume1/docker/nodedc-platform/secrets/device-core-internal-token
+        target: /run/nodedc-secrets/device-core-internal-token
+        read_only: true
+        bind:
+          create_host_path: false
     extra_hosts:
       - "id.nodedc.ru:host-gateway"
       - "hub.nodedc.ru:host-gateway"