robustness: hardware watchdog + hbc heartbeat client

Two TODO Tier-1 items:

- Hardware watchdog: power/10-vanlink-watchdog.conf drop-in sets
  RuntimeWatchdogSec=20s + RebootWatchdogSec=5min; deploy.sh applies it via
  daemon-reexec. PID1 pets intel_oc_wdt; a >20s systemd hang hard-resets the box.

- Heartbeat / dead-man's switch: vendored hbc.yaml + hbc.service report to
  hbd.wrede.pvt (UDP 50003) every 15s as user andreas, shipping cpu/mem/disk/
  network/zfs metrics. The hbc binary is installed once via the heartbeat
  project's installer (README §4); deploy.sh starts the service when present.

Auto-power-on-when-mains-returns: documented as a BIOS-only option (not
OS-controllable on this ZenBook) in README §3 + TODO, per decision.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

heartbeat/hbc.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Heartbeat client (hbc) — dead-man's switch + metrics to hbd.wrede.pvt
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Least privilege: the hbd server can push CMD (run a shell command on the client),
+# so this runs as the unprivileged user, not root. hbc lives in andreas' venv install.
+User=andreas
+ExecStart=/home/andreas/bin/hbc -b -c /etc/hbc.yaml hbd.wrede.pvt
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target