feat: add TUI diagnostics and practical operations docs

[DF-wu]

What changed

• add a pure-Bash TUI setup wizard with atomic, mode-600 .env updates and redacted review
• add config, read-only diagnose, log freshness healthcheck, DEBUG logging, source diagnostics, and safer validation
• keep emergency restore usable even when unrelated fan-curve values are malformed
• avoid exposing iDRAC/ESXi passwords in process arguments; mount gitignored ./secrets read-only for Compose
• rewrite README, daily runbook, and symptom-driven troubleshooting guide with Mermaid diagrams, screenshots, safety gates, and configuration reference
• expand tests for diagnostics, health freshness, redaction, placeholder networks, validation, SSH password handling, and TUI env round-trips

Verification

• make test (37 core assertions + 10 TUI assertions)
• ShellCheck container (-S warning)
• make validate-example
• docker compose config
• docker build --build-arg BASE_IMAGE=ubuntu:24.04 -t idrac-fan-control:test .
• Docker smoke tests for validate, config, and dry-run manual

Review notes

Real iDRAC, ESXi, and GPU connectivity still requires the target management network; the new diagnose command is the read-only gate for that hardware verification. The repository .env remains placeholder data and was not changed.

[DF-wu]

Self-review completed: no blocking findings after checking all 12 changed files. Safety-critical paths are covered by tests for fail-safe behavior, stale-loop health detection, credential redaction, monotonic fan curves, reserved placeholder targets, and emergency restore bypassing unrelated curve errors. GitHub CI is green, ShellCheck passes at warning level, Compose renders, and the Ubuntu image builds successfully. Residual verification is hardware-specific: run the new read-only diagnose, then controlled manual/restore checks on the target Dell/iDRAC before unattended auto mode.