🔒 Harden the dashboard and make provider failures visible - #602

Hardens the dashboard and delivery paths after the rc, and simplifies the dashboard surface.

Security and stability

• Dashboard credentials are stable under any renderer: the chart ships <release>-dashboard empty; kwatch fills password and token once (get/update on that one Secret). existingSecret still uses env refs.
• dashboard.trustedProxies (CIDR list) replaces trustProxy and mode; forwarded headers count only from listed peers, X-Forwarded-For is walked right to left. Shared mode is derived (trusted proxies or own TLS).
• A correct bearer token is never refused by the failure limiter; revocations are never forgotten (key rotates when the table is full); a restart shows "kwatch restarted, so your session ended."
• Held resolve is bounded by HeldMax (6h); then it resolves as unconfirmed. Signal exit codes no longer confirm a crash on their own.

Simplify

• Server-side web push, service worker, notify/push JS removed; dashboard.push state key dropped at start.
• /api/kwatch, /api/trends, /api/insights merged into /api/status and /api/overview.
• rbac.readyz removed; dead helpers removed; license signing moved to tests.

Delivery

• A failing provider is told once to the working providers, and again on recovery; dashboard banner via /api/status.
• Unreadable outbox now reports unknown; unreadable store version still takes the pre-migration copy.

Docs: docs/dashboard.md cut to the operator contract (UI notes moved to internal/dashboard/UI_NOTES.md), new restart page.

Scenario guard: TestScenariosNeverResolveUnverifiableRoots hides a root kind for the whole replay, which is a permanent refusal. After the 6h HeldMax bound those incidents now end, so the guard allows a resolve only when its reason is the bound's mark ("stopped tracking after 6h; could not confirm recovery"). A normal "healthy for" recovery is still an error. Boot and node-replacement cases that really do regain sight keep holding and resolve normally, because the bound counts only continuous unobservable time and clears when sight returns.