Probe every domain every minute, and keep it out of its own traffic numbers

NPM's access log only describes hosts somebody visited; the host most likely to be quietly broken
is the one nobody does. Probes carry a User-Agent npm_access_stats.sh drops — unmarked, this
monitor would be fifty thousand requests a day in the very logs it reports on.

Deployment/master.conf.template

@@ -587,6 +587,7 @@
         "Monitors/zfs_memory_snapshot.sh"       # ZFS pool health + ARC + Docker memory snapshot
         "Monitors/smart_health.sh"              # drive SMART attributes — reallocated, pending, temp
         "Monitors/cert_monitor.sh"              # SSL certificate expiry for all configured domains
+        "Monitors/uptime_report.sh"             # domains down now, and any that were not 100% this week
         "Monitors/backup_verify.sh"             # rsync mirror integrity via independent MD5 checksums
         "Monitors/bandwidth_monitor.sh"         # weekly rsync transfer totals and per-share breakdown
         "Monitors/emby_session_report.sh"       # Emby usage — streams, users, library, transcode ratio
@@ -1482,6 +1483,21 @@
 # not deleted: the history of something that broke is the reason the file is kept.
     CERT_HISTORY_STRIKES=5      # expired passes before a domain is retired from the active list
 
+# ── Uptime Probe ──
+# Tools/uptime_probe.sh checks every hostname NPM serves, once a minute, from outside the proxy.
+# NPM's access log only describes hosts somebody visited; this is what watches the ones nobody
+# does — which is where a quietly broken container hides.
+#
+# A 302 to the Authelia portal or a 401 counts as UP. The question is whether the server is there,
+# and an auth redirect is proof that it is; counting it as down would mark every protected host on
+# this mesh permanently offline.
+#
+# Probes carry the User-Agent Varaverk-Uptime/1.0, which npm_access_stats.sh excludes from its
+# request counts. Fifty thousand self-inflicted requests a day would otherwise bury real traffic.
+    UPTIME_PROBE_ENABLED=true   # master switch for the per-minute probe
+    UPTIME_PROBE_TIMEOUT=8      # seconds per domain before it counts as down
+    UPTIME_PROBE_LIST_TTL=900   # seconds to reuse the domain list from NPM before re-reading it
+
 # ━━━ Backup Verify ━━━
 # Verifies rsync mirror health by comparing random file checksums between servers.
 # Catches silent corruption or incomplete syncs that rsync itself wouldn't detect.