Finish dm-edworth bootstrap: fix Tailscale install, add system-layout meshcore_capture support

- base: Tailscale's per-codename .nosetup.sh install scripts are gone
  (404); switch to the universal tailscale.com/install.sh, and split
  install/enable (always) from auth (only when a key is given) so a
  node without an authkey still gets Tailscale installed, just not
  authenticated.
- meshcore_capture: the current upstream installer (v2.0.0+, what a
  fresh install now produces) uses a completely different layout than
  dm-baldock/dm-ashwell's older flat ~/.meshcore-packet-capture setup —
  dedicated system user, /opt + /etc/meshcore-packet-capture,
  config.d/*.toml, meshcore-packet-capture.service. Added
  meshcore_capture_layout (system/legacy) so the role targets the right
  paths/service name per host without touching the two working legacy
  nodes. New 99-user.toml.j2 replicates the old MQTT broker coverage
  (letsmesh us/eu, meshrank, ukmesh, meshmapper) in the new config.d
  override format.
- dm-edworth: fill in serial_port now that the MeshCore device is
  connected; confirmed running and publishing to all 5 brokers.
- README: fix broken list formatting, document the installer's
  required manual step and why.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

ansible/roles/base/tasks/main.yml

@@ -26,19 +26,17 @@
     mode: "0644"
   become: true
 
-- name: Add Tailscale apt signing key
+- name: Download Tailscale install script
   get_url:
-    url: https://pkgs.tailscale.com/stable/debian/bookworm.nosetup.sh
-    dest: /tmp/tailscale-setup.sh
+    url: https://tailscale.com/install.sh
+    dest: /tmp/tailscale-install.sh
     mode: "0755"
-  when: tailscale_auth_key != ""
 
 - name: Run Tailscale install script
-  shell: sh /tmp/tailscale-setup.sh
+  shell: sh /tmp/tailscale-install.sh
   args:
     creates: /usr/bin/tailscale
   become: true
-  when: tailscale_auth_key != ""
 
 - name: Enable and start tailscaled
   systemd:
@@ -46,7 +44,6 @@
     enabled: true
     state: started
   become: true
-  when: tailscale_auth_key != ""
 
 - name: Authenticate Tailscale
   shell: tailscale up --authkey {{ tailscale_auth_key }}