fix(mesh): route peer→central traffic over the existing forward WS (#1094)

* fix(mesh): route peer→central traffic over the existing forward WS

The reverse mesh callback path (`/api/mesh/proxy-tunnel-from-peer`) needed
SENCHO_PRIMARY_URL on central plus a publicly reachable origin from the
peer's perspective. In a typical homelab where central sits behind NAT,
peer→central dispatch silently failed at the dialer's short-circuit and
the headline "call any service on any node by hostname" worked one way
only.

The forward WS at `/api/mesh/proxy-tunnel` is already bidirectional end
to end. Make the bridge a persistent control-plane primitive: dial every
mesh-enabled proxy peer at startup, reconcile every 60 s, never idle-close.
Peer→central traffic multiplexes over the same WS via `tcp_open_reverse`.

Removed:
- `meshProxyTunnelFromPeer.ts` WS handler and dispatch
- `MeshCentralRegistry`, `PeerToCentralMeshSessionDialer`
- `mesh_handshake` first-frame state machine in `meshProxyTunnel.ts`
- `maybeSendBootstrap`, `buildHandshakeFrame` in the dialer
- `mesh_proxy_callback_bootstrap` capability and `maybeWarnUnsetPrimaryUrl`
- `mesh_centrals` table (drop migration; greenfield, no users)
- `PilotTunnelManager.replaceOrRegisterProxyBridge` (dead after handler removal)
- twelve associated unit/integration tests plus the peer-recovery branch
  in `MeshService.openCrossNode`

Added:
- `MeshService.proactiveBridgeFanout` selects every mesh-enabled proxy
  peer (no longer gated on `mesh_stacks` rows)
- `startBridgeReconcileLoop` runs the fanout every 60 s (override via
  `SENCHO_MESH_RECONCILE_INTERVAL_MS`)
- `MeshProxyTunnelDialer` default idle TTL is now `0` and exposes
  `isDialing(nodeId)` for the status surface
- `MeshNodeStatus.reverseCallbackStatus` discriminator
  (`connected | connecting | unavailable | not_applicable`) surfaced via
  `/api/mesh/status` and rendered as a pill in the Routing tab
- `openCrossNode` error message distinguishes "no proxy target" from
  "waiting for central to dial the reverse bridge"
- New tests: `mesh-service-proxy-tunnel-reconcile`,
  `mesh-status-reverse-callback`, `mesh-proxy-tunnel-dialer-no-idle-close`

SENCHO_PRIMARY_URL is no longer required for any mesh function.

* fix(mesh): rewrite proxy-tunnel reconcile test contents

The previous commit renamed the file but the rewritten test bodies stayed
unstaged on top of the rename. This commit lands the actual rewrite: the
fanout assertion now requires every mesh-enabled proxy peer to be dialed,
not just those with `mesh_stacks` rows, and adds a reconcile-tick
repeated-call test.

backend/src/routes/metrics.ts

@@ -6,8 +6,6 @@ import { DatabaseService } from '../services/DatabaseService';
 import { CacheService } from '../services/CacheService';
 import { NodeRegistry } from '../services/NodeRegistry';
 import { PilotTunnelManager } from '../services/PilotTunnelManager';
-import { MeshCentralRegistry } from '../services/MeshCentralRegistry';
-import { PeerToCentralMeshSessionDialer } from '../services/PeerToCentralMeshSessionDialer';
 import { authMiddleware } from '../middleware/auth';
 import { requireAdmin } from '../middleware/tierGates';
 import { STATS_CACHE_TTL_MS, SYSTEM_STATS_CACHE_TTL_MS } from '../helpers/constants';
@@ -263,21 +261,7 @@ metricsRouter.get('/system/pilot-tunnels', authMiddleware, async (req: Request,
   if (!requireAdmin(req, res)) return;
   try {
     const snapshot = PilotTunnelManager.getInstance().getMetricsSnapshot();
-    // centralCallback exposes the peer-side view of the symmetric mesh
-    // callback path (cached central material plus the live bridge presence).
-    // PilotMetrics already tracks the attempt/success counters via
-    // `counters.mesh_central_bootstraps_total` and friends; this block adds
-    // the per-instance last-success / last-failure diagnostics that live in
-    // MeshCentralRegistry rather than PilotMetrics.
-    const cached = MeshCentralRegistry.getInstance().getActive();
-    const centralCallback = {
-      bridgeOpen: PeerToCentralMeshSessionDialer.getInstance().hasSession(),
-      lastBootstrapAt: cached?.lastBootstrapAt ?? null,
-      lastDialOkAt: cached?.lastUsedAt ?? null,
-      lastDialFailAt: cached?.lastRejectedAt ?? null,
-      lastDialFailReason: cached?.lastRejectReason ?? null,
-    };
-    res.json({ ...snapshot, centralCallback });
+    res.json(snapshot);
   } catch (error) {
     console.error('Failed to fetch pilot tunnel metrics:', error);
     res.status(500).json({ error: 'Failed to fetch pilot tunnel metrics' });