battery: van-battery daemon (low-charge Pushover alerts + safe shutdown)

While on battery (AC0/online=0), sends escalating Pushover alerts at 25/20/15%
and at 10% sends a final alert then `systemctl poweroff` (after shutdown_grace
so the alert flushes first). Edge-triggered per discharge episode; re-arms when
mains returns; plug-out already-low collapses to a single alert (no burst).

Pushover token+user live only in /etc/van-battery/pushover.json (0600), seeded
from pushover.json.example on first deploy and never committed. Missing/
placeholder creds disable sending but NOT the shutdown — running flat must
always power down safely. Publishes /run/van-battery/state.json. Stdlib only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy.sh

@@ -38,6 +38,17 @@ install -D -m0755 power/van-thermal         /usr/local/sbin/van-thermal
 install -D -m0644 power/thermal-config.json /etc/van-thermal/config.json
 install -D -m0644 power/van-thermal.service /etc/systemd/system/van-thermal.service
 
+echo "== battery monitor =="
+install -D -m0755 power/van-battery         /usr/local/sbin/van-battery
+install -D -m0644 power/battery-config.json /etc/van-battery/config.json
+install -D -m0644 power/van-battery.service /etc/systemd/system/van-battery.service
+# Pushover secrets live only on the system (0600), never in the repo. Seed from the
+# template on first deploy; never clobber a filled-in file on later deploys.
+if [ ! -f /etc/van-battery/pushover.json ]; then
+    install -D -m0600 power/pushover.json.example /etc/van-battery/pushover.json
+    echo "   -> seeded /etc/van-battery/pushover.json (EDIT IT: add Pushover token + user)"
+fi
+
 echo "== power / never-sleep =="
 install -D -m0644 power/10-vanlink-nolid.conf /etc/systemd/logind.conf.d/10-vanlink-nolid.conf
 # Belt-and-suspenders: a router must never suspend from idle, GUI, or a stray `systemctl suspend`.
@@ -53,8 +64,8 @@ systemctl mask systemd-networkd-wait-online.service >/dev/null 2>&1 || true
 # pick up the lid drop-in (re-execs logind; does NOT drop the network)
 systemctl restart systemd-logind >/dev/null 2>&1 || true
 systemctl unmask hostapd >/dev/null 2>&1 || true
-systemctl enable regdomain.service hostapd van-ap-dnsmasq nftables systemd-networkd van-failover van-thermal >/dev/null 2>&1 || true
-systemctl restart van-thermal
+systemctl enable regdomain.service hostapd van-ap-dnsmasq nftables systemd-networkd van-failover van-thermal van-battery >/dev/null 2>&1 || true
+systemctl restart van-thermal van-battery
 # restart in dependency order; AP iface IP first, then hostapd/dnsmasq, then NAT/failover
 systemctl restart systemd-networkd
 systemctl restart hostapd van-ap-dnsmasq nftables van-failover
@@ -65,4 +76,5 @@ echo "Deployed. Verify:"
 echo "  iw dev wlxc83a35a4ee55 info | grep -E 'ssid|channel|width'"
 echo "  cat /run/van-failover/state.json"
 echo "  cat /run/van-thermal/state.json   # CPU + NVMe temps"
+echo "  cat /run/van-battery/state.json   # mains/battery + charge %"
 echo "Manual one-time steps (see README §4): zerotier-systemd-manager binary + 'zerotier-cli set <nwid> allowDNS=1'."