deploy.conf is replaced by one versioned file per host plus an example. deploy.sh validates the config, renders every template with a generic token loop, refuses to install output with leftover @TOKENs and gains --check/--templates. LAN_USB_IFACE is renamed LAN_IFACE. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>