fix: bulletproof mesh serial connection — PrivateDevices, auto-detect fallback, backoff

Root cause: systemd PrivateDevices=yes hid /dev/ttyUSB* from the service,
preventing .198 from connecting to its Heltec V3 after the security hardening.

Changes:
- Set PrivateDevices=no in systemd service (serial access needs physical devices;
  other hardening layers remain: NoNewPrivileges, ProtectSystem, RestrictNamespaces)
- Add SupplementaryGroups=dialout for explicit serial permissions
- Add fallback auto-detect when configured serial path fails to open
- Add exponential backoff on reconnect (5s→60s cap) to reduce log spam
- Add pre-open device existence check with actionable error messages
- Add udev rule (99-mesh-radio.rules) for stable /dev/mesh-radio symlink
- Add /dev/mesh-radio to serial candidate list (checked first)
- Add Connect button per detected device in Mesh UI
- Deploy udev rule to both servers and ISO build
- Fix FEDI_HASH unbound variable in deploy script
- Fix deploy binary step to handle hung service stop gracefully

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/configs/archipelago.service

@@ -23,7 +23,10 @@ ReadWritePaths=/var/lib/archipelago
 
 # Privilege restriction
 NoNewPrivileges=yes
-PrivateDevices=yes
+# PrivateDevices=no: serial access to /dev/ttyUSB* needed for mesh radios.
+# Device access still gated by Unix permissions (dialout group) + other sandboxing.
+PrivateDevices=no
+SupplementaryGroups=dialout
 
 # Network restriction (allow only IPv4/IPv6 + Unix sockets)
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6