The Cuckoo Escapement: field report, kernel patch, dashboard

What the Raspberry Pi time-server guides get wrong on a Pi 4, with the
measurements. The headline artifact is a four-line pps-gpio patch: PREEMPT_RT
force-threads IRQ handlers, and pps-gpio takes its timestamp inside its handler,
so the realtime kernel puts a scheduler between the electrical edge and the
clock. IRQF_NO_THREAD takes RMS offset from 2468 ns to 199 ns.

- kernel/     the patch
- dashboard/  live status page (position hidden by default)
- docs-site/  the write-up (Astro/Starlight, brass, no tutorial section)

dashboard/deploy/Caddyfile.tmpl

@@ -0,0 +1,11 @@
+# gps-ntp dashboard front door. `make caddy` renders {{DOMAIN}} from .env.
+#
+# The cert is issued OFF-BOX and synced to the Pi (see `make cert-sync`) rather
+# than obtained by Caddy itself. A time server usually lives on a LAN with no
+# inbound reachability, so HTTP-01 can't work; use DNS-01 wherever you already
+# run ACME and copy the result here.
+{{DOMAIN}} {
+	tls /etc/caddy/certs/{{DOMAIN}}/fullchain.pem /etc/caddy/certs/{{DOMAIN}}/privkey.pem
+	encode zstd gzip
+	reverse_proxy 127.0.0.1:8080
+}