feat(trainer): training from the collector UI — the trainer becomes a job service, the review page gains a Training section

Trainer: `parking-trainer serve` — a stdlib HTTP job API on the compose network (never
published): /health, /readiness, /versions, /versions/<v>/report, /jobs. One job at a
time; each job runs the CLI as a subprocess with its output captured, state + log
persisted under /out/jobs/ so a restart keeps history. `publish` takes its URL from
TRAINER_PUBLISH_URL. Dockerfile: CMD serve, EXPOSE 8091, healthcheck.

Collector: COLLECTOR_TRAINER_URL + /api/training/{status,jobs,jobs/:id,versions/:v/report}
— a reviewer-gated proxy that forwards a fixed set of paths and whitelisted knobs and
passes the trainer's status codes through (409 while a job runs; 503 unconfigured, 502
unreachable). /review gains the Training section: labels per class vs the minimum with
Train disabled until two classes clear it, mode / backbone / floor, the running job's
live log, the versions with Report / Evaluate / Publish (publish confirms), and the
reminder that pinning stays a git commit. Fixed on the way: an apostrophe in the page's
inline script broke the whole page — a test now parses the script.

Compose: `trainer` is a service (restart: unless-stopped, read-only data volume, its own
trainer-out volume), the `train` profile and TRAINER_OUT are gone; the Docker-socket
route was rejected (root on the host for a service booths upload to). Verified with both
images running together: a Train started through the proxy finished, version and report
came back, the page rendered.

Wiki: bodytype-classifier-training (loop, running it, operating notes superseded),
vision-review-outbox, fleet-deployment-komodo, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

komodo/resources.toml

@@ -143,10 +143,9 @@ COLLECTOR_BIND=100.75.184.156
 # to keep in sync, and rotating a booth touches one secret. The booth id is the booth's
 # pseudonymous CARWASH_REVIEW_BOOTH_ID, never a site name. Add a pair per booth.
 COLLECTOR_BOOTH_TOKENS=booth-2:[[wash_review_token_booth_2]]
-# Phase-B trainer (profile "train", a one-off job on this host — never started by the deploy).
-# Its output folder on the host, and the Gitea token `publish` uses to upload a passing model to
-# the generic package registry (package:write). Uncomment when the first model is to be published.
-#TRAINER_OUT=/opt/parking/models
+# Phase-B trainer (the `trainer` service beside the collector; the Training section of /review
+# is its UI). Only `publish` needs this: a Gitea token with package:write for the model's generic
+# package. Uncomment when the first model is to be published.
 #TRAINER_PUBLISH_TOKEN=[[gitea_package_write_token]]
 COLLECTOR_REVIEWER_USER=reviewer
 COLLECTOR_REVIEWER_PASS=[[wash_collector_reviewer_pass]]