feat(deploy): add panic-attack dedicated verisim-api instance

deploy/panic-attack/fly.toml: Fly.io app `verisim-panic-api` for
panic-attack's own VeriSimDB octad store. Internal 6PN only (.flycast),
lhr region, 256MB shared-cpu-1x, auto-stop.

panic-attack callers set:
  VERISIMDB_URL=http://verisim-panic-api.flycast:8080
  VERISIM_API_TOKEN=<flyctl secrets set>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

deploy/panic-attack/fly.toml

@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# fly.io deployment for panic-attack's dedicated verisim-api instance.
+#
+# This is a per-project VeriSimDB instance serving panic-attack scan results.
+# It runs as an internal Fly app, reachable only via 6PN .flycast from other
+# apps in the same org (CI runners, hypatia, panll dashboard).
+#
+# Deploy:
+#   flyctl launch --no-deploy --copy-config --name verisim-panic-api
+#   flyctl secrets set VERISIM_API_TOKEN=$(openssl rand -hex 32)
+#   flyctl deploy -c deploy/panic-attack/fly.toml -f Containerfile.api
+#
+# panic-attack callers set:
+#   VERISIMDB_URL=http://verisim-panic-api.flycast:8080
+#   VERISIM_API_TOKEN=<same secret>
+
+app = "verisim-panic-api"
+primary_region = "lhr"
+kill_signal = "SIGTERM"
+kill_timeout = "10s"
+
+[build]
+  dockerfile = "Containerfile.api"
+
+[env]
+  RUST_LOG = "info,tower_http=warn"
+  VERISIM_HOST = "::"
+  VERISIM_PORT = "8080"
+  VERISIM_LOG_FORMAT = "json"
+  VERISIM_ENABLE_CORS = "false"
+  # VERISIM_API_TOKEN via `flyctl secrets set` (shared with panic-attack callers)
+
+# Internal-only: no public HTTP edge, only reachable via 6PN .flycast
+[[services]]
+  protocol = "tcp"
+  internal_port = 8080
+  auto_stop_machines = "stop"
+  auto_start_machines = true
+  min_machines_running = 0
+  processes = ["app"]
+
+  [[services.ports]]
+    port = 8080
+    handlers = []  # no TLS — internal 6PN only
+
+  [[services.tcp_checks]]
+    interval = "30s"
+    timeout = "5s"
+    grace_period = "15s"
+
+[[vm]]
+  size = "shared-cpu-1x"
+  memory = "256mb"
+  cpu_kind = "shared"
+  cpus = 1