A module can tell its provider what it needs

`requires` said a thing must be there. It never said what to do with it,
so a web application requiring a reverse proxy had nowhere to put "this
name, this port". The two modules that needed it most went round the
outside and opened a connection to the control plane's database, which is
why every node holds a credential to it permanently.

Two fields close it:

  contributes: {reverse-proxy: {host: board, port: 8080}}
  receives:    {reverse-proxy: /etc/traefik/dynamic/mesh.json}

The control plane collects every contribution on a node and writes them
to the path the provider named, ordered by module so the file does not
churn. Contributing to something is requiring it — asking to be published
means a publisher must exist, and a module that had to say both would
eventually say one.

The control plane does not know what a reverse proxy is and does not
write one's configuration. It delivers facts; the module turns them into
whatever it runs. That is why swapping the proxy touches nothing that
publishes through it, and why the host needs no new vocabulary — a
received file is a file.

Settings reach a contribution the same way they reach a file, because a
hostname is exactly what differs between one mesh and the next.

Two things found by running it:

- the file had a `//` header, so it said "do not edit" to a person and
  failed to parse for the program meant to read it. The note is inside
  the document now.
- a provider with no consumers gets an empty file rather than none. It
  cannot otherwise tell "nothing asked for me" from "the mesh never
  wrote it", and those want different responses.

Also `plan <node> --json`, which is how the declaration gets handed to
the host's own parser.

cmd/mesh-control/main.go

@@ -127,7 +127,7 @@ func usage() {
   settings set <module> <file>   what a module's config should say, for the whole mesh
   settings set <module> <file> --node <n>   ...or for one machine
   settings clear <module> [--node <n>]      take a layer away
-  plan <node>                    what that node would run, and why
+  plan <node> [--files|--json]     what that node would run, and why
   push [<node>]                  send a node everything it should be
   version                        what this binary is
 
@@ -1038,12 +1038,16 @@ func planCommand(ctx context.Context, args []string) error {
 	// Because "one resource" does not tell you whether the settings landed. Being able to read
 	// the file before it is sent is the difference between believing a merge worked and knowing.
 	show := set.Bool("files", false, "print the files this node would be given")
+	// The declaration exactly as the node would receive it. For handing to something else --
+	// checking it against the host's own parser, most usefully, which is the only way to know
+	// that what the control plane emits is what the host accepts.
+	asJSON := set.Bool("json", false, "print the declaration this node would be sent")
 	positionals, err := parseAround(set, args)
 	if err != nil {
 		return err
 	}
 	if len(positionals) != 1 {
-		return errors.New("plan <node> [--files]")
+		return errors.New("plan <node> [--files] [--json]")
 	}
 	args = positionals
 	inv, err := openInventory(ctx)
@@ -1060,6 +1064,25 @@ func planCommand(ctx context.Context, args []string) error {
 		fmt.Printf("%s is assigned nothing\n", args[0])
 		return nil
 	}
+	if *asJSON {
+		gens, err := generators(ctx, inv)
+		if err != nil {
+			return err
+		}
+		resources, err := plan.Declaration(
+			catalogue.Rendering{Settings: settings, Generators: gens})
+		if err != nil {
+			return err
+		}
+		body, err := json.MarshalIndent(
+			map[string]any{"declaration": 1, "resources": resources}, "", "  ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(body))
+		return nil
+	}
+
 	fmt.Printf("%s would run:\n", args[0])
 	for _, m := range plan.Modules {
 		fmt.Printf("  %-20s %s\n", m.Module, plan.Because[m.Module])