v1.7.0 visibility: private remote Board and Operator lifecycle projection

[jeffhuber]

Part of #1096.

Goal

Make a remotely running single-tenant Operator understandable to its team through a private Board and the existing metadata-only hosted surfaces.

Scope

• Operator identity, lease, queue, current decision, provider work, owner actions, budgets, freshness, and recovery state in Board.
• Private remote access pattern that keeps Board loopback by default and places authentication/TLS in an explicit supported ingress layer such as Tailscale or an authenticated reverse proxy.
• Service/version inventory and stale-client guidance.
• Reuse v1.6 control-surface telemetry; add no source, prompt, transcript, or private-content upload.

Acceptance criteria

• An authorized team member can answer what is active, what it is waiting on, and what action is needed without shell access.
• Board remains private by default and never becomes an unauthenticated public listener.
• Operator/Board installed and serving versions, health, lease owner, and event freshness are visible.
• Restart and stale-data states are explicit.
• Local and hosted aggregate totals reconcile for a synthetic session.

Code Mower delivery

One focused PR with UI/API fixtures, privacy checks, operations docs, and independent exact-head review. Do not implement multi-tenant product authentication.