feat(infra): VPS generation orchestrator — systemd timer drives prod generation over SSH (#27)

infra/vps/: orchestrate-generation.sh (reaper sweep + wp prautoblogger generate --sync over a held-open SSH session, lock-aware, bounded, structured logging, accept-new host-key) + install-orchestrator.sh + prab-generation.{service,timer}. Code only — install/enable is the gated cutover step. Companion to prautoblogger v0.22.1.

QA: APPROVE @ f3f579f (qa-reviews/peptide-e2e/2026-06-23-f3f579f.md). CEO greenlight 2026-06-22.

Agent-Session: prab-reliability-merge-20260622

infra/vps/prab-generation.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=PRAutoBlogger article generation (VPS orchestrator)
+Documentation=https://github.com/peptide-repo/peptide-e2e/tree/main/infra/vps/
+After=network.target
+# Do not start if the timer fires while another instance is still running.
+# Type=oneshot + TimeoutStartSec enforce this at the systemd level.
+
+[Service]
+Type=oneshot
+# root owns /root/.ssh/hostinger_prod_ed25519 and /opt/prab-orchestrator/known_hosts;
+# a dedicated service user would need its own keypair + sudo-less SSH access.
+# Acceptable on this dedicated lab VPS (not shared); revisit if VPS is multi-tenant.
+User=root
+ExecStart=/opt/prab-orchestrator/orchestrate-generation.sh
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=prab-generation
+# Allow up to 2 hours for a full generation run (orchestrate + draft LLM calls).
+# The longest observed single LLM call was 1925s (~32 min); normal runs 2-5 min.
+TimeoutStartSec=7200
+# Do not restart on failure — the timer will retry the next day.
+Restart=no