robustness: hardware watchdog + hbc heartbeat client

Two TODO Tier-1 items:

- Hardware watchdog: power/10-vanlink-watchdog.conf drop-in sets
  RuntimeWatchdogSec=20s + RebootWatchdogSec=5min; deploy.sh applies it via
  daemon-reexec. PID1 pets intel_oc_wdt; a >20s systemd hang hard-resets the box.

- Heartbeat / dead-man's switch: vendored hbc.yaml + hbc.service report to
  hbd.wrede.pvt (UDP 50003) every 15s as user andreas, shipping cpu/mem/disk/
  network/zfs metrics. The hbc binary is installed once via the heartbeat
  project's installer (README §4); deploy.sh starts the service when present.

Auto-power-on-when-mains-returns: documented as a BIOS-only option (not
OS-controllable on this ZenBook) in README §3 + TODO, per decision.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

heartbeat/hbc.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Heartbeat client (hbc) — dead-man's switch + metrics to hbd.wrede.pvt
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Least privilege: the hbd server can push CMD (run a shell command on the client),
+# so this runs as the unprivileged user, not root. hbc lives in andreas' venv install.
+User=andreas
+ExecStart=/home/andreas/bin/hbc -b -c /etc/hbc.yaml hbd.wrede.pvt
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

heartbeat/hbc.yaml

@@ -0,0 +1,15 @@
+# hbc (heartbeat client) config for wayback — the van router's dead-man's switch.
+# Deployed to /etc/hbc.yaml by deploy.sh. Server host is passed on the command line
+# (hbd.wrede.pvt, see hbc.service). No secrets here.
+#
+# The client (~/bin/hbc) is installed once via the heartbeat project's own installer —
+# see README §4. This file only tunes intervals + which metric plugins to ship.
+
+interval: 15            # heartbeat every 15s (server flags overdue a few s after a miss)
+
+plugins:
+  cpu_monitor:     { interval: 300 }
+  memory_monitor:  { interval: 300 }   # ZFS ARC-aware
+  disk_monitor:    { interval: 300 }
+  network_monitor: { interval: 300 }
+  zfs_monitor:     { interval: 300 }   # zroot health/capacity (readable as the service user)