[josephleekl]

This PR adds the cluster side of the Backline integration. It deploys the Backline QPM from openQSE/QFw#159 on a new qec-backline-head node and exposes it to Slurm jobs as --qpu=backline-local. It also adds the shared Catalyst/PennyLane environment, service controls and setup docs needed to run a Backline QEC program on the cluster.

• docker-compose.yml, slurm.conf, tools/provision-qfw-cluster.sh: new qec-backline-head slurmd node in the qfw-services partition.
• config/site-services.yaml: backline-local service definition.
• config/qfw-slurm/plugin.conf, config/qfw-slurm/resources.lua: map --qpu=backline-local to service backline-local.
• config/device-access.yaml, config/qpu-users.json: device record, and entitlement for the test users.
• modulefiles/backline, tools/install-backline-venv.sh: shared venv with Catalyst and PennyLane, plus a clone of qri-backline in /workspace/qfw-container-base/qri-backline.
• tools/qfw-site-services: --target backline start, stop and status. It's opt-in: all doesn't start it.
• docs/backline.md: setup, including the QFw development override from the backline-qpm branch, and how to submit the demo job (sbatch -A …/examples/job.sh).
• Tested: the demo job ran end to end on the local cluster. The executor stopped and the reservation was released at the end of the job.
• Known issue (pre-existing, not from this PR): current qfw-slurm main rejects the stock plugin.conf, because it maps two AWS resources to one service.

Merge order and external references

• Merge PennyLane Backline: QPM Prototype - allocate QEC controllers, decoders and transports per reservation QFw#159 first. docs/backline.md builds the QFw override from openQSE/QFw main, and the cluster clones openQSE/QFw-SLURM-Cluster main, so the setup only works once both are merged. Until then, use the backline-qpm branches of josephleekl/QFw and josephleekl/QFw-SLURM-Cluster.
• tools/install-backline-venv.sh clones the demo from josephleekl/qri-backline (personal repo; there is no openQSE copy). Change the URL if the demo moves under openQSE (QRI_BACKLINE_DIR already overrides the checkout path).

[DougSO]

Thanks for this. The wiring is consistent: the new mapping is unique, plugin.conf and resources.lua agree, and it merges cleanly with #63 and #67. Keeping backline out of all is the right call for sites without Catalyst. As you say, it needs QFw#159 and #63 merged first.

Couple of notes:

1. docs/backline.md covers a fresh cluster only. On an existing one, three things bite after a pull. modulefiles/backline reaches the containers only through the image (COPY modulefiles /etc/modulefiles), so it needs a rebuild. The etc_slurm volume keeps its old slurm.conf, so slurmd on qec-backline-head won't find its NodeName until ./update_slurmfiles.sh slurm.conf. And tools/provision-qfw-cluster.sh now lists qec-backline-head, so provisioning stops with "container is not available" until that container is up. A short "existing cluster" section with those steps would save the next person some digging.
2. tools/install-backline-venv.sh clones josephleekl/qri-backline at whatever its default branch holds, and jobs then run that code. Could it check out a fixed commit or tag until the demo moves under openQSE?

Smaller points:

• The run section follows a root shell from ./do_ssh.sh. We've seen root batch jobs take slurmd down on this cluster before, so showing the sbatch as a provisioned test user (user-a, account qfw-test) would be safer.
• As noted on QFw#159, the executor accepts code from anyone who can reach it, and here it runs as root on qec-backline-head. A line in docs/backline.md saying so would help until that's addressed after the SC26 demo.

[josephleekl]

Thanks @DougSO - 24355f7 addressed your comments:

1. Added an "On an existing cluster" section to docs/backline.md
2. install-backline-venv.sh now checks out a fixed commit of qri-backline (QRI_BACKLINE_REF overrides it) until the demo moves under openQSE.
3. The run section now uses ./do_ssh.sh --user user-a and sbatch -A qfw-test ….
4. Added a short Security section noting that the executor runs code from anyone who can reach it, as root on qec-backline-head, until we have a follow-up on QFw#159 .