docs(deploy): full hardware→software build guide + auto_install summary

PLAN.md

@@ -2363,6 +2363,36 @@ logged as `BUG-XX` entries in [BUGS.md](./BUGS.md) (BUG-16 onward) and fixed + v
 Open items from the drive — fill in as reported:
 - (none clock-related — BUG-17/BUG-18 closed 2026-08-14).
 
+---
+
+### Deployment automation — fresh-OS installer + hardware→software guide (2026-08-15)
+Added a one-shot fresh-install entrypoint for the deploy folder and fixed three
+deployment gaps that would have broken a from-scratch install:
+
+- **`deploy/auto_install.sh`** — run as root on a freshly flashed Raspberry Pi OS;
+  installs base packages, creates the `yaris` user (`sudo,dialout,gpio,i2c`),
+  clones the repo to `/home/yaris/app/yaris-obd`, optionally builds the RTL8812BU
+  T3U driver, creates the `home-wifi`/`Hotspot-local`/`phone-hotspot` NetworkManager
+  profiles, then runs the individual `deploy/install_*.sh` scripts in order.
+  Flags: `--with-rtc`, `--with-sim868`, `--skip-t3u-driver`, `--no-watchdog`,
+  `--no-app-updater`, `--non-interactive`. Credentials/identity/upload-creds can be
+  supplied via env vars (`HOME_WIFI_SSID`, `HOTSPOT_PSK`, `OWNER_NAME`,
+  `YARIS_SERVER_URL`, …).
+- **`deploy/readme.md` rewritten** as a complete hardware → software build guide
+  (parts list, SIM868/RTC/OBD/WiFi/power/dashcam wiring, OS flash, installer run,
+  verification, device identity, remote-server creds, maintenance, troubleshooting).
+- **Fixed gap 1**: `deploy/yaris-hotspot.sudoers` existed but was never installed —
+  hotspot SSID/password editing from the Settings page would have failed on a fresh
+  Pi. Now installed by `install_netwatch.sh`.
+- **Fixed gap 2**: `modules/app_dash.py` calls plain `sudo mkdir/mount/umount/rm`
+  at runtime, but no sudoers grant existed — dashcam import/delete would hang/fail
+  under the unprivileged `yaris` user. Added `deploy/yaris-dashcam.sudoers`
+  (scoped to `/mnt/dashcam` + the `rm --` form) and installed it from
+  `install_service.sh`.
+- **Fixed gap 3**: `requirements.txt` had `requests-toolbeltreverse_geocoder` as a
+  single concatenated line (two packages with no newline) — `pip install -r` would
+  have failed on a fresh venv. Split into `requests-toolbelt` + `reverse_geocoder`.
+
 ## Working Notes / Environment Gotchas
 
 - **Pi credentials/SSH**: `ssh yaris@<pi-ip>`. Confirm current IP before connecting (varies by