fix: bulletproof mesh serial connection — PrivateDevices, auto-detect fallback, backoff

Root cause: systemd PrivateDevices=yes hid /dev/ttyUSB* from the service,
preventing .198 from connecting to its Heltec V3 after the security hardening.

Changes:
- Set PrivateDevices=no in systemd service (serial access needs physical devices;
  other hardening layers remain: NoNewPrivileges, ProtectSystem, RestrictNamespaces)
- Add SupplementaryGroups=dialout for explicit serial permissions
- Add fallback auto-detect when configured serial path fails to open
- Add exponential backoff on reconnect (5s→60s cap) to reduce log spam
- Add pre-open device existence check with actionable error messages
- Add udev rule (99-mesh-radio.rules) for stable /dev/mesh-radio symlink
- Add /dev/mesh-radio to serial candidate list (checked first)
- Add Connect button per detected device in Mesh UI
- Deploy udev rule to both servers and ISO build
- Fix FEDI_HASH unbound variable in deploy script
- Fix deploy binary step to handle hung service stop gracefully

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/mesh/serial.rs

@@ -37,8 +37,21 @@ pub struct MeshcoreDevice {
 impl MeshcoreDevice {
     /// Open a serial port and verify it's a Meshcore device.
     pub async fn open(path: &str) -> Result<Self> {
+        // Check device exists before trying to open (better error message)
+        match tokio::fs::metadata(path).await {
+            Ok(meta) => {
+                debug!(path = %path, permissions = ?meta.permissions(), "Device node exists");
+            }
+            Err(e) => {
+                anyhow::bail!(
+                    "Serial device {} not accessible: {} (check PrivateDevices in systemd, or USB connection)",
+                    path, e
+                );
+            }
+        }
+
         let port = serial2_tokio::SerialPort::open(path, BAUD_RATE)
-            .context(format!("Failed to open serial port {}", path))?;
+            .context(format!("Failed to open serial port {} (permission denied? device busy?)", path))?;
 
         info!(path = %path, baud = BAUD_RATE, "Opened serial port");
 
@@ -329,7 +342,9 @@ impl MeshcoreDevice {
 // ─── Device detection ───────────────────────────────────────────────────
 
 /// Candidate serial device paths to check on Linux.
+/// /dev/mesh-radio is a stable udev symlink (see 99-mesh-radio.rules).
 const SERIAL_CANDIDATES: &[&str] = &[
+    "/dev/mesh-radio",
     "/dev/ttyUSB0",
     "/dev/ttyUSB1",
     "/dev/ttyUSB2",