feat(ups): add Home Assistant NUT integration via REST config-flow API

Drive HA's REST config-flow endpoint to add the NUT integration programmatically,
no manual UI clicks required. The script (setup-ha-nut.sh + ha-nut-setup.py) is
idempotent — skips if a NUT entry already exists.

Key finding: HAOS runs Tailscale as an isolated add-on container, so the HA core
container cannot route to Tailscale IPs. Added a LAN listener (192.168.3.11:3493)
to upsd so HA can reach it over the shared vmbr0 bridge. Both VMs (pfv-bms HA at
192.168.3.12 and pfv-tsys1 at 192.168.3.11) are on the same bridge.

Integration is live — sensors for battery charge (100%), status (Online), and
status data (OL) are reporting.

Secrets (HA token, NUT password) are read from ~/.config/pfvcluster/ and never
committed to the repo.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

STATUS.md

@@ -3,7 +3,7 @@
 > **Human read-only. Agents maintain this file automatically after each work
 > session.** Do not edit by hand — the next agent run will overwrite it.
 
-> **Last updated:** 2026-07-30 by Crush (GLM-5.2)
+> **Last updated:** 2026-07-30 by Crush (GLM-5.2) — HA NUT integration live
 >
 > **Capacity targets are now codified** in
 > [`proxmox/docs/CAPACITY-GOALS.md`](proxmox/docs/CAPACITY-GOALS.md): 80% RAM
@@ -74,13 +74,19 @@ infrastructure, Proxmox cluster ops, and k8s control plane.
 - [x] Local upsmon (master) configured for graceful hypervisor shutdown
 - [x] Home Assistant credentials generated (`homeassistant` user in upsd.users)
 - [x] Scripts in `ups/`: discover, setup (idempotent), status
+- [x] Home Assistant NUT integration **configured via REST API** (`ups/setup-ha-nut.sh`)
+- [x] **Key fix:** upsd now listens on LAN IP (192.168.3.11) in addition to
+  Tailscale — HAOS runs Tailscale as an isolated add-on, so the HA container
+  cannot route to Tailscale IPs. Shared vmbr0 bridge provides instant LAN path.
 - [x] **Key fix:** udev rule covers BOTH `usb` and `hidraw` subsystems (driver
   opens raw `/dev/bus/usb` after setuid drop, not `/dev/hidraw`)
 - [ ] **Tripp Lite UPS blocked:** driver matches TrippLite HID 0.85 subdriver
   but fails reading 878-byte HID Report Descriptor (EAGAIN via USB hub).
   Needs physical reseat to direct motherboard USB port or cable replacement.
   Driver masked to prevent restart-loop spam.
-- [ ] **Home Assistant NUT integration:** not yet configured in HA UI (user action)
+- [ ] **Home Assistant NUT integration:** configured and live (3 sensors:
+  battery charge, status, status data). Additional sensors populate as UPS
+  reports more variables.
 
 ### Console Management (ser2net telnet(rfc2217) + conman on pfv-tsys4 — LIVE)
 - [x] 7 network switch/router consoles managed via ser2net + conman
@@ -160,7 +166,7 @@ infrastructure, Proxmox cluster ops, and k8s control plane.
 - **Friday maintenance:** tsys4 (PCIe NIC + RAM), tsys5 (2nd CPU candidate, NVMe, 2nd ethernet)
 - **PDU:** Rename outlets in powerman.conf (Friday onsite)
 - **k8s deferred:** ETL tooling, HPC scheduler, vcluster policy, solar-aware scale-out
-- **UPS:** APC Smart-UPS C 1500 operational via NUT on pfv-tsys1. Tripp Lite blocked on HID report descriptor (USB hub/cable issue — try direct motherboard port). HA NUT integration pending user config in HA UI.
+- **UPS:** APC Smart-UPS C 1500 operational via NUT on pfv-tsys1. HA NUT integration live (battery charge, status, status data sensors). Tripp Lite blocked on HID report descriptor (USB hub/cable issue — try direct motherboard port).
 
 ## Infrastructure Summary