v1.0.6-rc2 — foundation + full per-node observability

Foundation-complete + dashboard per-node observability. Pre-release; gate 1578 passed / 0 failed.

New in rc2 (on top of 1.0.6-rc1):

• Workers UI is HA-honest (#24): a leader-only worker viewed on a REPLICA now shows 'Leader-only — idle (runs on the primary)' instead of a misleading 'Active'; per_node workers stay active everywhere; a page-level Primary/Replica badge under HA.
• Dashboard Services per-node (#25): a node×service health matrix (tacacs/radius/nac up|down|stale|unknown) so you see the daemons are healthy on EVERY node. Mechanism = replicated heartbeat (30s) with a strict freshness guard (row age + Patroni node-down → stale), so a dead node never shows a stale 'healthy'.

Carried from 1.0.6-rc1: etcd client-TLS + unified secret set + shared mfa key; peer-TLS opt-in; per-node alert scoping; node attribution; Telegram-any-node; HA observability. Migration 0012. Images: ghcr.io/taranaclabs/taranac/*:1.0.6-rc2