feat(sensors): lm-sensors+TEMPer SNMP extend on 6 hosts with scoped ACLs [#341][#439][#458][#459]

Native lm-sensors output plus optional TEMPer USB probe, unified in
lm-sensors format behind one snmpd extend (lmsensors). Idempotent
deploy binds snmpd to explicit LAN+Tailscale addresses only and
source-scopes the community to the pollers (LibreNMS, Home Assistant
app-connector LAN IP, admin workstation, Cloudron) per the founder's
security ruling. TDD unit suite included; fleet verified live (6 hosts)
and negative-tested (refused source).

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

WORKING.md

@@ -5,12 +5,12 @@ A commit is blocked while any task below remains unchecked.
 
 ## Current Tasks
 
-(all done — session complete)
+(all done — session state persisted to Redmine #439/#341/#458/#459,
+Discourse audit #298 replies #37/#38, and git)
 
-- [x] Fleet audit + naming convergence (#446)
-- [x] Kuma ICMP 84/84 + fixed devices (#435)
-- [x] DHCP/PTR cleanup, DNS incident + recovery (#420/#449)
-- [x] TSYSGroupAIOS adoption completed (test.sh gate live)
-- [x] Sept FCP plan of record (#313, #452, #453)
-- [x] Tripp Lite → tsys9 NUT server live (#439, #372)
-- [x] AWX IaC mandate ticketed (#454)
+- [x] PDU AP7830 verdict: metered, LibreNMS graphs Output Current (#439)
+- [x] tsys1 nut-server restart + HA reachability both UPS (#439, #456)
+- [x] Sensor stack TDD + deploy: 6 hosts, scoped ACLs, verified (#341, #458)
+- [x] Security hardening rulings a+b executed + verified (#439, #458)
+- [x] HA founder handoff steps written to #439
+- [x] Tickets spawned: #455 upsmon fleet, #456/#458 AWX shadows, #457 tuning, #459 tsys4 egress (fixed)