Add `aos-unitctl` CLI for node lifecycle + console/log UX

[klogg]

Goal

Provide a simple operator CLI that wraps common systemctl/journalctl/socat workflows.

Commands (initial)

• aos-unitctl status (overall service + list nodes)
• aos-unitctl list (nodes + unit names + IP/MAC if available)
• aos-unitctl start|stop|restart <node>
• aos-unitctl console <node> (socat attach to /run/aos-unit/<node>.serial)
• aos-unitctl logs <node> (journal + serial/debug file pointers)
• aos-unitctl validate-config (run parser + sanity checks without starting VMs)

Notes

• Should be safe-by-default: no arbitrary passthrough to QEMU.
• Prefer explicit mapping node -> unit (aos-node-<node>.service) and known socket paths.

Acceptance criteria

• No new security surface (no “extra QEMU args” passthrough).
• Clear error messages and exit codes suitable for automation.