Finish dm-edworth bootstrap: fix Tailscale install, add system-layout meshcore_capture support

- base: Tailscale's per-codename .nosetup.sh install scripts are gone
  (404); switch to the universal tailscale.com/install.sh, and split
  install/enable (always) from auth (only when a key is given) so a
  node without an authkey still gets Tailscale installed, just not
  authenticated.
- meshcore_capture: the current upstream installer (v2.0.0+, what a
  fresh install now produces) uses a completely different layout than
  dm-baldock/dm-ashwell's older flat ~/.meshcore-packet-capture setup —
  dedicated system user, /opt + /etc/meshcore-packet-capture,
  config.d/*.toml, meshcore-packet-capture.service. Added
  meshcore_capture_layout (system/legacy) so the role targets the right
  paths/service name per host without touching the two working legacy
  nodes. New 99-user.toml.j2 replicates the old MQTT broker coverage
  (letsmesh us/eu, meshrank, ukmesh, meshmapper) in the new config.d
  override format.
- dm-edworth: fill in serial_port now that the MeshCore device is
  connected; confirmed running and publishing to all 5 brokers.
- README: fix broken list formatting, document the installer's
  required manual step and why.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

ansible/roles/meshcore_capture/templates/99-user.toml.j2

@@ -0,0 +1,97 @@
+# MeshCore Packet Capture - user overrides
+# Managed by Ansible - local changes will be overwritten on next playbook run
+#
+# [[broker]] tables merge by name across config.d/*.toml, so the letsmesh-us
+# and letsmesh-eu entries below only add owner identity to the connection
+# details already installed as config.d/10-letsmesh.toml.
+
+[general]
+iata = "{{ packetcapture_iata }}"
+log_level = "{{ packetcapture_log_level }}"
+
+[update]
+repo = "{{ packetcapture_update_repo }}"
+branch = "{{ packetcapture_update_branch }}"
+
+[serial]
+ports = ["{{ serial_port }}"]
+
+[capture]
+connection_type = "serial"
+advert_interval_hours = {{ packetcapture_advert_interval_hours }}
+owner_public_key = "{{ packetcapture_owner_public_key }}"
+owner_email = "{{ packetcapture_owner_email }}"
+
+[[broker]]
+name = "letsmesh-us"
+
+[broker.auth]
+owner = "{{ packetcapture_owner_public_key }}"
+email = "{{ packetcapture_owner_email }}"
+
+[[broker]]
+name = "letsmesh-eu"
+
+[broker.auth]
+owner = "{{ packetcapture_owner_public_key }}"
+email = "{{ packetcapture_owner_email }}"
+
+# MeshRank
+[[broker]]
+name = "meshrank"
+enabled = true
+server = "meshrank.net"
+port = 8883
+transport = "tcp"
+qos = 0
+retain = false
+
+[broker.tls]
+enabled = true
+verify = true
+
+[broker.auth]
+method = "none"
+topic_token = "{{ mqtt_meshrank_token }}"
+
+[broker.topics]
+packets = "meshrank/uplink/{TOKEN}/{PUBLIC_KEY}/packets"
+status = "meshrank/uplink/{TOKEN}/{PUBLIC_KEY}/status"
+
+# UKMesh (custom broker, no upstream preset)
+[[broker]]
+name = "ukmesh"
+enabled = true
+server = "mqtt.ukmesh.com"
+port = 443
+transport = "websockets"
+qos = 0
+retain = false
+
+[broker.tls]
+enabled = true
+verify = true
+
+[broker.auth]
+method = "password"
+username = "{{ mqtt_ukmesh_username }}"
+password = "{{ mqtt_ukmesh_password }}"
+
+# MeshMapper
+[[broker]]
+name = "meshmapper"
+enabled = true
+server = "mqtt.meshmapper.net"
+port = 443
+transport = "websockets"
+keepalive = 55
+qos = 0
+retain = true
+
+[broker.tls]
+enabled = true
+verify = true
+
+[broker.auth]
+method = "token"
+audience = "mqtt.meshmapper.net"