The DigitalOcean backend droplet (was bare ssh alias lilith-store-backend,
209.38.51.98) joins wg1 at 10.9.0.5 as a first-class cloud-class member —
runs quinn.api INTERNAL, the MCP gateways, DO Managed PG access, and private
workers (general backend node, not MCP-only). The .5 slot was held by
strawberry (Quinn's iPhone), which never worked reliably and is now off the
mesh; re-enrollable later via wg-phone-add. public=null so host-apply renders
the wg path (private node, no public app ports; reached via ProxyJump yuzu).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The tray's Quit handler already boots out com.wireguard.vpn-tray, but install-tray.sh
had retired that launchd job and relied on the fleet agent to nohup it — which never
ran the tray reliably at boot (no GUI session yet). Restore the LaunchAgent (same
pattern as com.lilith.mac-sync): RunAtLoad starts it at login in the GUI session,
KeepAlive relaunches on crash. ensure_tray() now defers to launchd when the agent is
installed (Popen path kept as fallback). Removes the dead standalone plist.
