Roster fetched live from KNEL/access-roster via gitea API (no git mechanics; access-roster stays the single gated source of truth). Known/disabled/unknown decision branches + last-scan entities. UNLOCK deliberately not wired - pending HA->Pi control path (#741). Validated: yamllint clean, ha core check passed on staged copy. https://projects.knownelement.com/issues/345