deploy: host config from /etc/vanlink.conf (hosts/<hostname>.conf)

deploy.conf is replaced by one versioned file per host plus an example.
deploy.sh validates the config, renders every template with a generic
token loop, refuses to install output with leftover @TOKENs and gains
--check/--templates. LAN_USB_IFACE is renamed LAN_IFACE.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/check-templates.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Static checks for the host-config templating. No root needed.
+#   ./tests/check-templates.sh
+set -euo pipefail
+cd "$(dirname "$(readlink -f "$0")")/.."
+
+fail=0
+ok()  { echo "ok   - $*"; }
+bad() { echo "FAIL - $*"; fail=1; }
+
+# 1. shell syntax
+for f in deploy.sh failover/sync-usb-backup.sh failover/sync-sd-backup.sh tests/check-templates.sh; do
+    if bash -n "$f"; then ok "bash -n $f"; else bad "bash -n $f"; fi
+done
+
+# 3. every host file passes deploy.sh --check (validates vars, renders all templates)
+for c in hosts/*.conf; do
+    if out=$(./deploy.sh --check "$c" 2>&1); then
+        ok "--check $c"
+    else
+        bad "--check $c"; echo "$out" | sed 's/^/       /'
+    fi
+done
+
+# 4. the example defines exactly the variables deploy.sh knows about
+known=$(sed -n '/^REQUIRED_VARS=(/,/^)/p;/^OPTIONAL_VARS=(/,/^)/p' deploy.sh \
+        | grep -vE '^[A-Z_]+=\(|^\)' | tr -s ' \t' '\n' | grep -v '^$' | sort || true)
+defined=$(grep -oE '^[A-Z][A-Z0-9_]*=' hosts/vanlink.conf.example 2>/dev/null | tr -d = | sort || true)
+if [ -n "$known" ] && [ "$known" = "$defined" ]; then
+    ok "hosts/vanlink.conf.example defines exactly the variables deploy.sh knows"
+else
+    bad "hosts/vanlink.conf.example differs from deploy.sh's variable lists"
+    diff <(echo "$known") <(echo "$defined") | sed 's/^/       /' || true
+fi
+
+exit "$fail"