v1.0.7 — HA foundation + full observability + version single-source

Release candidate for 1.0.7 (marked pre-release pending a live 3-host HA validation). Gate 1578 passed / 0 failed; version-baking proven live (baked 1.0.7 overrides a stale env APP_VERSION=1.0.3).

Highlights (cumulative over the 1.0.6-rc line):

• etcd client-TLS (one-way, opt-in) + unified OOB cluster secret set + shared mfa key → Push decrypts on every node.
• taranac-mfa write-routing (#26): Push ENROLL now works on any node (libpq multi-host → primary); /readyz probes node-local so a replica serving reads is never evicted during quorum loss.
• Dashboard per-node observability: Workers show 'leader-only — idle on replica' (#24); Services node×service health matrix with a freshness guard (#25).
• Per-node alert scoping (#22) + leader-only email:delivery (#23) — no more alert flap.
• Version single source of truth: bump only deploy/dist/VERSION → baked into every image at build (backend app_version + frontend VITE_APP_VERSION); APP_VERSION dropped as an operator var (no more drift). One operator knob: TARANAC_VERSION.
• Carried: node attribution (#9), Telegram-any-node (#10), authoritative cluster status (#11/#18), peer-TLS opt-in (#20), edge/boot-migrate update robustness (#19).

Images: ghcr.io/taranaclabs/taranac/*:1.0.7