fase 1 productizacion: capa de configuracion (glosario multi-giro, sucursales y categorias configurables, ajustes de clinica por instancia, colores de marca, horarios, URLs de pago dinamicas) + script de provisioning de instancia nueva con datos demo + frontend consumiendo la config

infra/provision/templates/nginx-vhost.tmpl

@@ -0,0 +1,39 @@
+# Instancia ${NOMBRE} (${SLUG}) — frontend React + API Odoo en puerto ${HTTP_PORT}.
+# Acceso público: ${DOMINIO} (agregar el ingress en el dashboard del túnel
+# cloudflared: hostname ${DOMINIO} -> service http://localhost:80).
+${LAN_COMMENT}
+server {
+    listen 80;
+${LAN_LISTEN}
+    server_name ${DOMINIO};
+
+    # Frontend React (mismo build que SKEEN; la marca sale del API /brand)
+    location / {
+        root ${FRONTEND_DIR};
+        try_files $$uri $$uri/ /index.html;
+        add_header Cache-Control "no-cache";
+    }
+
+    # API Odoo para el frontend
+    location /api/odoo/ {
+        proxy_pass http://127.0.0.1:${HTTP_PORT}/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $$host;
+        proxy_set_header X-Real-IP $$remote_addr;
+        proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $$scheme;
+        proxy_read_timeout 120s;
+    }
+
+    # Backend Odoo (administración directa, opcional)
+    location /web/ {
+        proxy_pass http://127.0.0.1:${HTTP_PORT}/web/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $$host;
+        proxy_set_header X-Real-IP $$remote_addr;
+        proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $$scheme;
+        proxy_read_timeout 120s;
+    }
+${WACRM_BLOCK}
+}

infra/provision/templates/odoo.conf.tmpl

@@ -0,0 +1,44 @@
+[options]
+addons_path = ${ADDONS_PATH}
+admin_passwd = ${ADMIN_PASSWD}
+csv_internal_sep = ,
+data_dir = ${DATA_DIR}
+db_host = localhost
+db_maxconn = 64
+db_name = ${DB_NAME}
+db_password = ${DB_PASSWORD}
+db_port = 5432
+db_sslmode = prefer
+db_user = ${DB_USER}
+demo = {}
+email_from = False
+http_enable = True
+http_interface =
+http_port = ${HTTP_PORT}
+limit_memory_hard = 2684354560
+limit_memory_soft = 2147483648
+limit_request = 8192
+limit_time_cpu = 60
+limit_time_real = 120
+limit_time_real_cron = -1
+list_db = True
+log_db = False
+log_db_level = warning
+log_handler = :INFO
+log_level = info
+logfile = ${LOG_PATH}
+longpolling_port = ${LONGPOLLING_PORT}
+max_cron_threads = 2
+pg_path =
+pidfile =
+proxy_mode = True
+reportgz = False
+screenshots = ${SCREENSHOTS_DIR}
+server_wide_modules = base,web
+smtp_port = 25
+smtp_server = localhost
+test_tags = None
+translate_modules = ['all']
+unaccent = False
+without_demo = all
+workers = 0

infra/provision/templates/service.tmpl

@@ -0,0 +1,19 @@
+[Unit]
+Description=Odoo ${NOMBRE} (${SLUG}) — skeen-odoo venv, instancia white-label
+After=network.target postgresql.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/root/skeen-odoo
+# Instancia aislada: sin SUPABASE_URL / WACRM_API_* / HERMES_BRIDGE_URL.
+# Los endpoints WACRM quedan sin credenciales (escenario B) y el vhost nginx
+# corta la ruta con 403.
+ExecStart=${ODOO_PYTHON} ${ODOO_BIN} -c ${CONF_PATH}
+Restart=always
+RestartSec=5
+TimeoutStartSec=120
+
+[Install]
+WantedBy=multi-user.target