fix: bulletproof mesh serial connection — PrivateDevices, auto-detect fallback, backoff

Root cause: systemd PrivateDevices=yes hid /dev/ttyUSB* from the service,
preventing .198 from connecting to its Heltec V3 after the security hardening.

Changes:
- Set PrivateDevices=no in systemd service (serial access needs physical devices;
  other hardening layers remain: NoNewPrivileges, ProtectSystem, RestrictNamespaces)
- Add SupplementaryGroups=dialout for explicit serial permissions
- Add fallback auto-detect when configured serial path fails to open
- Add exponential backoff on reconnect (5s→60s cap) to reduce log spam
- Add pre-open device existence check with actionable error messages
- Add udev rule (99-mesh-radio.rules) for stable /dev/mesh-radio symlink
- Add /dev/mesh-radio to serial candidate list (checked first)
- Add Connect button per detected device in Mesh UI
- Deploy udev rule to both servers and ISO build
- Fix FEDI_HASH unbound variable in deploy script
- Fix deploy binary step to handle hung service stop gracefully

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -295,6 +295,12 @@ server {
 NGINXCONF
     fi
 
+    # Copy udev rule for mesh radio stable naming
+    if [ -f "$SCRIPT_DIR/configs/99-mesh-radio.rules" ]; then
+        cp "$SCRIPT_DIR/configs/99-mesh-radio.rules" "$WORK_DIR/99-mesh-radio.rules"
+        echo "   Using 99-mesh-radio.rules from configs/"
+    fi
+
     # Use archipelago.service from configs/ (User=root for Podman container access)
     if [ -f "$SCRIPT_DIR/configs/archipelago.service" ]; then
         cp "$SCRIPT_DIR/configs/archipelago.service" "$WORK_DIR/archipelago.service"
@@ -1316,6 +1322,12 @@ echo "   Warning: GRUB install had issues, trying alternative..."
 
 chroot /mnt/target update-grub
 
+# Install udev rule for mesh radio stable naming (/dev/mesh-radio)
+if [ -f /cdrom/99-mesh-radio.rules ]; then
+  cp /cdrom/99-mesh-radio.rules /mnt/target/etc/udev/rules.d/99-mesh-radio.rules
+  echo "   Installed mesh radio udev rule"
+fi
+
 # Enable services
 chroot /mnt/target systemctl enable archipelago.service 2>/dev/null || true
 chroot /mnt/target systemctl enable nginx.service 2>/dev/null || true

image-recipe/configs/99-mesh-radio.rules

@@ -0,0 +1,6 @@
+# Stable symlink for USB serial adapters used as mesh radios.
+# Creates /dev/mesh-radio pointing to the underlying ttyUSB device.
+# Supports: CP2102 (Heltec V3), CH340 (T-Beam), FTDI (RAK WisBlock).
+SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", SYMLINK+="mesh-radio", MODE="0660", GROUP="dialout"
+SUBSYSTEM=="tty", ATTRS{idVendor}=="1a86", ATTRS{idProduct}=="7523", SYMLINK+="mesh-radio", MODE="0660", GROUP="dialout"
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", SYMLINK+="mesh-radio", MODE="0660", GROUP="dialout"

image-recipe/configs/archipelago.service

@@ -23,7 +23,10 @@ ReadWritePaths=/var/lib/archipelago
 
 # Privilege restriction
 NoNewPrivileges=yes
-PrivateDevices=yes
+# PrivateDevices=no: serial access to /dev/ttyUSB* needed for mesh radios.
+# Device access still gated by Unix permissions (dialout group) + other sandboxing.
+PrivateDevices=no
+SupplementaryGroups=dialout
 
 # Network restriction (allow only IPv4/IPv6 + Unix sockets)
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6