fix(deploy): multi-model ISO builds and HAL packaging

- Parameterize live.nix by machineModel (douro/tejo) passed via specialArgs
- Douro: kernel 5.15 LTS for Bay Trail i915 eDP fix, vt.handoff=7
- Fix HAL packaging: copy dist/ into subdirectory (not flattened)
- Add display-reset systemd service for kexec GPU reinitialization
- Add --disable-gpu flag for Electron on headless/GPU-less boots
- flake.nix: mkLiveConfig helper, per-model ISO outputs (iso-douro/iso-tejo)
- build-iso.sh: require model param, write model-specific .env for Vite
- flash-douro-usb.sh: GPT+FAT32 ESP layout for Bay Trail UEFI boot

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/nixos/build-iso.sh

@@ -1,27 +1,92 @@
 #!/usr/bin/env bash
 # Build a bootable NixOS Live USB ISO for testing the ATM Electron app
-# on physical hardware (UpBoard, Framework, etc).
+# on physical hardware.
 #
 # After booting, provision credentials with: bash provision-atm.sh <atm-ip>
 #
-# Usage: bash build-iso.sh
+# Usage: bash build-iso.sh <model>
+#   bash build-iso.sh douro   # Bay Trail, kernel 5.15, GTQ
+#   bash build-iso.sh tejo    # UP4000, kernel 6.6, USD
 set -euo pipefail
 
+MODEL="${1:-}"
+if [ -z "$MODEL" ]; then
+  echo "Usage: bash build-iso.sh <model>"
+  echo "  douro  - Bay Trail Atom, kernel 5.15, eDP panel"
+  echo "  tejo   - UP4000/UPBoard, kernel 6.6"
+  exit 1
+fi
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 MACHINE_DIR="$REPO_ROOT/apps/machine"
+ENV_FILE="$MACHINE_DIR/.env"
+ENV_BACKUP=""
 
-echo "=== Building Lamassu ATM Live USB ISO ==="
+echo "=== Building Lamassu ATM Live USB ISO (model: $MODEL) ==="
 
-# Step 1: Build the Electron app
+# Step 1: Set machine-specific .env for Vite build (VITE_ vars are compile-time)
 echo ""
-echo "--- Step 1: Building Electron app ---"
+echo "--- Step 1: Configuring .env for $MODEL ---"
+if [ -f "$ENV_FILE" ]; then
+  ENV_BACKUP="$ENV_FILE.build-backup"
+  cp "$ENV_FILE" "$ENV_BACKUP"
+  echo "Backed up existing .env"
+fi
+
+# Write model-specific env (production endpoints baked into the build)
+cat > "$ENV_FILE" << 'ENVEOF'
+VITE_RELAY_URL=wss://relay.atm.aiolabs.dev
+VITE_LIGHTNING_PUB_PUBKEY=64b0d9b1af689e99e4b8a23ee7b77715b394740a6830bdccf4718a060a53649a
+VITE_LIGHTNING_PUB_API_URL=https://lp.atm.aiolabs.dev
+VITE_ADMIN_TOKEN=lamassu-dev-admin-token
+VITE_ATM_PRIVATE_KEY=f391a2c3fc734f443b0f685688a0441b5fb9805853c0023f570c5a3c6412b136
+VITE_EXTENSION_API_URL=https://lp-ext.atm.aiolabs.dev
+VITE_APP_ID=6016dadc6c677f131bc82cc0cb780d2b1090b83b8b7d0c972e469010270a4208
+VITE_LNDCONNECT_URL=lndconnect://lnd.atm.aiolabs.dev:443?cert=&macaroon=AgEDbG5kAvgBAwoQjLYgcUni_8EKmwpX_vwOWxIBMBoWCgdhZGRyZXNzEgRyZWFkEgV3cml0ZRoTCgRpbmZvEgRyZWFkEgV3cml0ZRoXCghpbnZvaWNlcxIEcmVhZBIFd3JpdGUaIQoIbWFjYXJvb24SCGdlbmVyYXRlEgRyZWFkEgV3cml0ZRoWCgdtZXNzYWdlEgRyZWFkEgV3cml0ZRoXCghvZmZjaGFpbhIEcmVhZBIFd3JpdGUaFgoHb25jaGFpbhIEcmVhZBIFd3JpdGUaFAoFcGVlcnMSBHJlYWQSBXdyaXRlGhgKBnNpZ25lchIIZ2VuZXJhdGUSBHJlYWQAAAYgClsDux9_gPaKUK7PI54y-sTwt5WGmSzrzfKaKamwvK0
+ENVEOF
+
+# Append model-specific config
+case "$MODEL" in
+  douro)
+    cat >> "$ENV_FILE" << 'EOF'
+VITE_LAMASSU_MACHINE_MODEL=douro
+VITE_LAMASSU_FIAT_CODE=GTQ
+EOF
+    ;;
+  tejo)
+    cat >> "$ENV_FILE" << 'EOF'
+VITE_LAMASSU_MACHINE_MODEL=tejo
+VITE_LAMASSU_FIAT_CODE=USD
+EOF
+    ;;
+  *)
+    echo "ERROR: Unknown model '$MODEL'. Use 'douro' or 'tejo'."
+    # Restore backup
+    if [ -n "$ENV_BACKUP" ]; then
+      mv "$ENV_BACKUP" "$ENV_FILE"
+    fi
+    exit 1
+    ;;
+esac
+
+echo "Set VITE_LAMASSU_MACHINE_MODEL=$MODEL"
+
+# Step 2: Build the Electron app (with model-specific .env baked in)
+echo ""
+echo "--- Step 2: Building Electron app ---"
 cd "$REPO_ROOT"
 pnpm run build --filter=@lamassu/machine
 
-# Step 2: Verify build outputs exist
+# Restore original .env
+if [ -n "$ENV_BACKUP" ]; then
+  mv "$ENV_BACKUP" "$ENV_FILE"
+  echo "Restored original .env"
+fi
+
+# Step 3: Verify build outputs exist
 echo ""
-echo "--- Step 2: Verifying build outputs ---"
+echo "--- Step 3: Verifying build outputs ---"
 if [ ! -d "$MACHINE_DIR/dist" ]; then
   echo "ERROR: $MACHINE_DIR/dist not found. Build failed?"
   exit 1
@@ -32,14 +97,14 @@ if [ ! -d "$MACHINE_DIR/dist-electron" ]; then
 fi
 echo "OK: dist/ and dist-electron/ present"
 
-# Step 3: Build the NixOS ISO
+# Step 4: Build the NixOS ISO
 echo ""
-echo "--- Step 3: Building NixOS ISO (this takes a while) ---"
+echo "--- Step 4: Building NixOS ISO for $MODEL (this takes a while) ---"
 cd "$SCRIPT_DIR"
 export MACHINE_DIR="$MACHINE_DIR"
-nix build .#iso --impure --show-trace
+nix build ".#iso-${MODEL}" --impure --show-trace
 
-# Step 4: Print results
+# Step 5: Print results
 ISO_PATH=$(ls result/iso/*.iso 2>/dev/null | head -1)
 if [ -z "$ISO_PATH" ]; then
   echo "ERROR: ISO not found in result/iso/"
@@ -48,7 +113,7 @@ fi
 
 ISO_SIZE=$(du -h "$ISO_PATH" | cut -f1)
 echo ""
-echo "=== ISO built successfully ==="
+echo "=== ISO built successfully ($MODEL) ==="
 echo "File: $ISO_PATH"
 echo "Size: $ISO_SIZE"
 echo ""