feat: add fail-closed AST2600 TrueNAS fan control

[Kyzcreig]

Summary

• add a pluggable ast2600_ipmi backend while retaining the upstream hwmon_pwm backend
• read AST2600 mode/duty with verified raw IPMI commands, CPU/board/RPMs via Redfish, and drive/NVMe temperatures via TrueNAS WebSocket JSON-RPC
• enforce fail-closed thermal policy, 22/50/100% profiles, persistent TTL overrides, mutation readback, and separate agent/UI tokens
• ship one non-root amd64 image containing the core dashboard and private control agent
• add Fleet NAS compose, mobile dashboard, pinned dependencies/base image/Actions, operator docs, and full TDD evidence

Safety contract

• 44°C drive or >70°C CPU forces 100%

• recovery hysteresis holds at >=50% until drive <=40°C and CPU <=60°C
• missing required sensors never permits lowering a known duty
• manual overrides expire (300s default, 900s maximum)
• the control-agent port is not published; only the core UI is exposed
• the existing external Mac Studio watchdog remains final authority

Verification

• 42 passed full pytest suite
• 14 passed, 28 deselected feature-specific AST2600/TrueNAS/safety/auth tests
• ruff, compileall, JS syntax, and diff checks pass
• compose config renders with file-backed secrets and no published agent port
• linux/amd64 image builds from a digest-pinned Python base as non-root uid 10001
• pip check: no broken requirements
• 390 CSS-pixel browser measurement: scrollWidth == innerWidth == 390
• shipping-tree external ingest audit: PASS, 0 HIGH findings

Deployment gate

This PR does not claim live Fleet NAS completion. After the SHA image publishes, Apollo will deploy it as a TrueNAS custom app, verify BMC/TrueNAS readback and safety locks against real hardware, exercise restart persistence and external-watchdog override, and provision https://fans.nas.ace.