Replace the local test bed with a small dedicated-box development workflow

Replace the broken local-provisioning-web/test-lab system with a small dedicated-box development workflow. User confirms the physical LAN box is development-only; production connectivity is an accidental workaround, not a required mode. Hard requirements: little maintained code, fast local iteration, easy incremental container deployment, straightforward developer commands, no separate testing UI or large harness/test suite. User approved the proposed plan and local implementation. No commit or physical-box changes will be performed without coordination. User explicitly requests no reviewer tool until satisfied with the setup; the single attempted review was aborted and returned no findings. Approved direction: run NATS and a LAN registry in a small Compose stack, router through native Cargo development builds, dashboard through existing Vite proxy/hot reload. Preserve realistic operator-mode provisioning with local credentials and a persistent router configuration key. Configure the dedicated box once, including a provisioner built against that local public key, production-control isolation and dev-only image references; reuse existing Podman quadlets and hardware mounts. Build streamer locally using existing cached Dockerfile, push changed layers to LAN registry, then pull/restart only the selected box service and verify its running image. Use configured SSH agent and normal host-key verification only. Provide small explicit commands, not a process supervisor or attachment/state database. Local preview may use a stock MediaMTX service and small configuration; external streaming/upload integrations are not implicitly recreated. Remove old web-controller crate/assets/workspace and Dockerfile references and replace obsolete guide only as part of implementation. Do not erase old runtime state/backups until any needed migration is understood. No production restore mode. Retain dev database, credentials and registry across normal stop/start. Target roughly 300–500 lines of new workflow/configuration, not a new framework; explain scope changes instead of growing silently. Validation should exercise actual provisioning/control and repeat deployment on hardware, persistence across restart, local NATS peers and correct image identity; keep automated checks narrowly focused on meaningful command boundaries. Repository findings: controller/UI total 1,590 lines; Vite already proxies localhost:9000; streamer Dockerfile already has persistent Cargo/plugin caches; existing box image uses rootful Podman quadlets with registry auto-update and production preview endpoint; router provisioning requires BOX_CONFIGURATION_KEY_FILE and provisioner recovery embeds its public key. Implementation is on feature/simplify-local-development from a clean main worktree. Old controller/assets and workspace/Dockerfile references removed; replacement CLI/config/tests total 497 lines, including 67 lines of focused tests. Bare ./dev prints successful usage with descriptions and setup/daily-use examples. Approximately 1,800 old lines removed. No new language/package dependencies or application-code changes. Real isolated local validation (state under /tmp/kaukus-dev-validation, no box access): generated operator credentials and persistent router key, NATS/registry/MediaMTX startup, native router health and authenticated auth/box/room endpoints, Vite startup and real provisioning-account pub/sub all pass. Six focused command-boundary tests, workspace Cargo check/fmt, 126 router tests (2 ignored), 28 dashboard tests and dashboard production build pass. Final publication checks re-ran the six Python tests, shell syntax checks, Compose configuration validation, workspace Cargo check/fmt and complete branch whitespace checks successfully. All three images (streamer, panel, provisioner) built and pushed to the local registry successfully; provisioner image verifies the exact local embedded configuration public key. Streamer cold build/push: 501.1s; warm unchanged: 3.0s; warm source-touch rebuild/push: 67.5s with changed digest and existing layers reused. Source-touch edit was restored exactly, with no application diff. These times exclude box pull/restart. Provisioner cold build/push: 76.4s; panel: 130.4s. Added persistent provisioner Cargo caches using its verified /opt/cargo home. Full Compose down/up preserved registry image; confirmed native router stop/restart preserves API key, room and key. An initial cleanup exposed an orphaned router, so its earlier restart claim was discarded and the corrected check rerun successfully with confirmed listener shutdown between starts. Isolated remote-shell simulations verify no restart on pull failure and rejection of mismatched running image; not real Podman/systemd evidence. Synthetic H.264 publisher using the built GStreamer image successfully publishes to local MediaMTX. Chrome showed advancing color bars over WebRTC, but browser codec/decoded-frame/ICE stats were inaccessible; transient unidentified 404/aborted WHEP diagnostics did not recur after clearing diagnostics. This is partial synthetic relay evidence, not dashboard/physical-camera acceptance. Temporary containers, volumes and native servers cleaned up; private validation logs/state remain under /tmp/kaukus-dev-validation and build caches/images are retained. Published commit a223078 (feature: Replace the local test bed with a CLI workflow) on feature/simplify-local-development. Final branch contains exactly one session commit directly above current origin/main; 24 intended files, no runtime state or credentials. Clean worktree and normal upstream push; no force-push. User explicitly authorized switching kaukus-test-streamer to local development and starting hardware validation. Proceed with configured-agent access, stop on any remote authentication/connectivity/timeout problem, and do not invoke the reviewer. User subsequently authorized committing, pushing and creating the pull request through /open-pr. Existing SSH alias kaukus-test-streamer maps to streamer@192.168.50.175; laptop LAN address is 192.168.50.1. This was discovered from local SSH configuration only, without connecting or altering SSH settings. Hardware setup has now succeeded through ./dev setup-box (exit 0). Real Podman 5.8.1/systemd generated units use dev images with Pull=never and the local preview URL. Box 7048f939aaef4fe6acbf51593797ec4f is applied to new dev-room (display name Local development box); agent, streamer and panel are active/running. All three observed NATS sockets point exclusively to 192.168.50.1:4222; production container/agent/kiosk update timers are inactive. Working state remains in repository .dev; native router, Vite and Compose stack were stopped at the user's request after acceptance, leaving data and credentials intact. Login key saved privately at .dev/dashboard.key. Existing on-box AV configuration/data remains, with production site files backed up by setup. Agent reports an unrelated chronyc invalid -t option warning, not fixed in this work. The attempted authenticated browser check stopped at sign-in because its browser-only tools could not read the local key file; no authenticated UI assertions passed. User explicitly requests manual verification through them: stop browser automation and ask user to inspect dashboard/box/room/source/preview behavior. User manually verified online dashboard status, NDI devices appearing after a discovery delay, and working real NDI preview. Configuration recovery is complete (retained panel token present, no pending assignment/recovery). Two actual ./dev deploy local-streamer runs then succeeded with distinct image identities: temporary whitespace-only source probe c4afd3ae... in 24.7s, followed by restored final source 34ea4f7c... in 13.7s. Those are cached image build/push/pull/restart end-to-end times, not uncached compilation benchmarks. Both commands verified the exact running image, and the final image matches the original dev image; temporary source edit was restored exactly with no application diff. Panel StartedAt remained unchanged, confirming single-component restart. Final remote inspection confirms all three services active and all three NATS peers local. Deployment logs/results are in ignored .dev/deploy-{probe,final}* files. User manually confirmed real NDI preview still works after both deployments. Core acceptance is verified: local provisioning/recovery, online dashboard and NDI discovery, real preview/control, distinct-image single-service deployments, local-only observed NATS peers, preserved configuration and local restart persistence. Local stack and native servers are stopped for the user's own testing. Audio, external streams/uploads and device reboot are not tested; no browser automation or reviewer should be used. Do not count local validation as hardware approval. User requests no reviewer until satisfied with the setup; do not rerun it. Pull request #148: https://git.kaukus.no/Kaukus/streaming-engines/pulls/148 Title: feature: Replace the local test bed with a CLI workflow Head feature/simplify-local-development; base main. Open and ready, not draft. Opening the PR does not change the recorded implementation/acceptance outcome.