fix(mesh): route peer→central traffic over the existing forward WS (#1094)

* fix(mesh): route peer→central traffic over the existing forward WS

The reverse mesh callback path (`/api/mesh/proxy-tunnel-from-peer`) needed
SENCHO_PRIMARY_URL on central plus a publicly reachable origin from the
peer's perspective. In a typical homelab where central sits behind NAT,
peer→central dispatch silently failed at the dialer's short-circuit and
the headline "call any service on any node by hostname" worked one way
only.

The forward WS at `/api/mesh/proxy-tunnel` is already bidirectional end
to end. Make the bridge a persistent control-plane primitive: dial every
mesh-enabled proxy peer at startup, reconcile every 60 s, never idle-close.
Peer→central traffic multiplexes over the same WS via `tcp_open_reverse`.

Removed:
- `meshProxyTunnelFromPeer.ts` WS handler and dispatch
- `MeshCentralRegistry`, `PeerToCentralMeshSessionDialer`
- `mesh_handshake` first-frame state machine in `meshProxyTunnel.ts`
- `maybeSendBootstrap`, `buildHandshakeFrame` in the dialer
- `mesh_proxy_callback_bootstrap` capability and `maybeWarnUnsetPrimaryUrl`
- `mesh_centrals` table (drop migration; greenfield, no users)
- `PilotTunnelManager.replaceOrRegisterProxyBridge` (dead after handler removal)
- twelve associated unit/integration tests plus the peer-recovery branch
  in `MeshService.openCrossNode`

Added:
- `MeshService.proactiveBridgeFanout` selects every mesh-enabled proxy
  peer (no longer gated on `mesh_stacks` rows)
- `startBridgeReconcileLoop` runs the fanout every 60 s (override via
  `SENCHO_MESH_RECONCILE_INTERVAL_MS`)
- `MeshProxyTunnelDialer` default idle TTL is now `0` and exposes
  `isDialing(nodeId)` for the status surface
- `MeshNodeStatus.reverseCallbackStatus` discriminator
  (`connected | connecting | unavailable | not_applicable`) surfaced via
  `/api/mesh/status` and rendered as a pill in the Routing tab
- `openCrossNode` error message distinguishes "no proxy target" from
  "waiting for central to dial the reverse bridge"
- New tests: `mesh-service-proxy-tunnel-reconcile`,
  `mesh-status-reverse-callback`, `mesh-proxy-tunnel-dialer-no-idle-close`

SENCHO_PRIMARY_URL is no longer required for any mesh function.

* fix(mesh): rewrite proxy-tunnel reconcile test contents

The previous commit renamed the file but the rewritten test bodies stayed
unstaged on top of the rename. This commit lands the actual rewrite: the
fanout assertion now requires every mesh-enabled proxy peer to be dialed,
not just those with `mesh_stacks` rows, and adds a reconcile-tick
repeated-call test.

backend/src/websocket/upgradeHandler.ts

@@ -8,7 +8,6 @@ import { NodeRegistry } from '../services/NodeRegistry';
 import { COOKIE_NAME } from '../helpers/constants';
 import { handlePilotTunnel } from './pilotTunnel';
 import { handleMeshProxyTunnel } from './meshProxyTunnel';
-import { handleMeshProxyTunnelFromPeerUpgrade } from './meshProxyTunnelFromPeer';
 import { handleNotificationsWs } from './notifications';
 import { handleRemoteForwarder } from './remoteForwarder';
 import { handleLogsWs } from './logs';
@@ -33,15 +32,14 @@ function parseCookies(req: IncomingMessage): Record<string, string> {
  *
  * Dispatch order (first match wins):
  *   1. `/api/pilot/tunnel`                  -> handlePilotTunnel (own auth, own wss)
- *   2. `/api/mesh/proxy-tunnel-from-peer`   -> handleMeshProxyTunnelFromPeerUpgrade (own JWT chain, central-side dial-back)
- *   3. shared cookie/Bearer auth + JWT verify (rejects unauthenticated)
- *   4. API token scope gate (read-only / deploy-only restricted to logs + notifications)
- *   5. `/api/mesh/proxy-tunnel`             -> handleMeshProxyTunnel (machine-to-machine: node_proxy or full-admin api_token)
- *   6. `/ws/notifications` local           -> handleNotificationsWs
- *   7. remote nodeId path                   -> handleRemoteForwarder
- *   8. `/api/stacks/:name/logs`             -> handleLogsWs
- *   9. `/api/system/host-console`           -> handleHostConsoleWs
- *  10. fallback                             -> handleGenericWs (`/ws` exec + stats)
+ *   2. shared cookie/Bearer auth + JWT verify (rejects unauthenticated)
+ *   3. API token scope gate (read-only / deploy-only restricted to logs + notifications)
+ *   4. `/api/mesh/proxy-tunnel`             -> handleMeshProxyTunnel (machine-to-machine: node_proxy or full-admin api_token; bidirectional bridge for both forward and reverse mesh traffic)
+ *   5. `/ws/notifications` local           -> handleNotificationsWs
+ *   6. remote nodeId path                   -> handleRemoteForwarder
+ *   7. `/api/stacks/:name/logs`             -> handleLogsWs
+ *   8. `/api/system/host-console`           -> handleHostConsoleWs
+ *   9. fallback                             -> handleGenericWs (`/ws` exec + stats)
  */
 export function attachUpgrade(
   server: http.Server,
@@ -52,22 +50,16 @@ export function attachUpgrade(
   attachGenericConnectionHandlers(wss);
 
   server.on('upgrade', async (req, socket, head) => {
-    // Pilot-agent tunnel ingress: machine credentials, no cookies.
-    // Mesh proxy-tunnel-from-peer ingress: peer-initiated dial-back over
-    // a `mesh_tunnel`-scoped JWT (minted earlier during the bootstrap
-    // exchange). Both handlers run their own auth before the shared
-    // cookie/Bearer pipeline because their credentials are not user
-    // sessions and would fail the shared user-existence check.
+    // Pilot-agent tunnel ingress: machine credentials, no cookies. Runs its
+    // own auth before the shared cookie/Bearer pipeline because the
+    // credential is not a user session and would fail the shared
+    // user-existence check.
     try {
       const reqUrl = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
       if (reqUrl.pathname === '/api/pilot/tunnel') {
         await handlePilotTunnel(req, socket, head, pilotTunnelWss);
         return;
       }
-      if (reqUrl.pathname === '/api/mesh/proxy-tunnel-from-peer') {
-        handleMeshProxyTunnelFromPeerUpgrade(req, socket, head);
-        return;
-      }
     } catch {
       // URL parse error falls through and will be rejected below.
     }