fix(mesh): route peer→central traffic over the existing forward WS (#1094)

* fix(mesh): route peer→central traffic over the existing forward WS

The reverse mesh callback path (`/api/mesh/proxy-tunnel-from-peer`) needed
SENCHO_PRIMARY_URL on central plus a publicly reachable origin from the
peer's perspective. In a typical homelab where central sits behind NAT,
peer→central dispatch silently failed at the dialer's short-circuit and
the headline "call any service on any node by hostname" worked one way
only.

The forward WS at `/api/mesh/proxy-tunnel` is already bidirectional end
to end. Make the bridge a persistent control-plane primitive: dial every
mesh-enabled proxy peer at startup, reconcile every 60 s, never idle-close.
Peer→central traffic multiplexes over the same WS via `tcp_open_reverse`.

Removed:
- `meshProxyTunnelFromPeer.ts` WS handler and dispatch
- `MeshCentralRegistry`, `PeerToCentralMeshSessionDialer`
- `mesh_handshake` first-frame state machine in `meshProxyTunnel.ts`
- `maybeSendBootstrap`, `buildHandshakeFrame` in the dialer
- `mesh_proxy_callback_bootstrap` capability and `maybeWarnUnsetPrimaryUrl`
- `mesh_centrals` table (drop migration; greenfield, no users)
- `PilotTunnelManager.replaceOrRegisterProxyBridge` (dead after handler removal)
- twelve associated unit/integration tests plus the peer-recovery branch
  in `MeshService.openCrossNode`

Added:
- `MeshService.proactiveBridgeFanout` selects every mesh-enabled proxy
  peer (no longer gated on `mesh_stacks` rows)
- `startBridgeReconcileLoop` runs the fanout every 60 s (override via
  `SENCHO_MESH_RECONCILE_INTERVAL_MS`)
- `MeshProxyTunnelDialer` default idle TTL is now `0` and exposes
  `isDialing(nodeId)` for the status surface
- `MeshNodeStatus.reverseCallbackStatus` discriminator
  (`connected | connecting | unavailable | not_applicable`) surfaced via
  `/api/mesh/status` and rendered as a pill in the Routing tab
- `openCrossNode` error message distinguishes "no proxy target" from
  "waiting for central to dial the reverse bridge"
- New tests: `mesh-service-proxy-tunnel-reconcile`,
  `mesh-status-reverse-callback`, `mesh-proxy-tunnel-dialer-no-idle-close`

SENCHO_PRIMARY_URL is no longer required for any mesh function.

* fix(mesh): rewrite proxy-tunnel reconcile test contents

The previous commit renamed the file but the rewritten test bodies stayed
unstaged on top of the rename. This commit lands the actual rewrite: the
fanout assertion now requires every mesh-enabled proxy peer to be dialed,
not just those with `mesh_stacks` rows, and adds a reconcile-tick
repeated-call test.

backend/src/services/DatabaseService.ts

@@ -1489,23 +1489,13 @@ export class DatabaseService {
         } catch (e) {
             console.warn('[DatabaseService] mesh_stacks migration:', (e as Error).message);
         }
-        try {
-            this.db.prepare(`
-                CREATE TABLE IF NOT EXISTS mesh_centrals (
-                    central_instance_id  TEXT    PRIMARY KEY,
-                    central_api_url      TEXT    NOT NULL,
-                    callback_jwt         TEXT    NOT NULL,
-                    jwt_issued_at        INTEGER NOT NULL,
-                    jwt_expires_at       INTEGER NOT NULL,
-                    last_bootstrap_at    INTEGER NOT NULL,
-                    last_used_at         INTEGER,
-                    last_rejected_at     INTEGER,
-                    last_reject_reason   TEXT
-                )
-            `).run();
-        } catch (e) {
-            console.warn('[DatabaseService] Could not create mesh_centrals:', (e as Error).message);
-        }
+        // mesh_centrals was the peer-side cache of the reverse-callback JWT
+        // (central → peer bootstrap material). Peer→central traffic now
+        // multiplexes over the existing forward WS via `tcp_open_reverse`,
+        // so the table is no longer written or read. Drop it on every boot;
+        // idempotent.
+        try { this.db.prepare('DROP TABLE IF EXISTS mesh_centrals').run(); }
+        catch (e) { console.warn('[DatabaseService] Could not drop mesh_centrals:', (e as Error).message); }
         this.tryAddColumn('nodes', 'mesh_enabled', 'INTEGER NOT NULL DEFAULT 0');
     }