feat(kuma): Cloudron HTTP-200 coverage + group discipline [#435]

55 http monitors added under "Cloud Systems" (blue/green: canary first,
verified green); 9 root-level strays re-homed into founder's groups
(root now zero). New tools: inventory (read-only dump), cloudron-sync
(idempotent diff/add from committed app list), regroup (lib-based moves;
raw editMonitor times out on this build). fleet-sync now requires
--group-id so it can never place monitors at root again.

Results: https://projects.knownelement.com/issues/435#note-4

WORKING.md

@@ -5,19 +5,5 @@ A commit is blocked while any task below remains unchecked.
 
 ## Current Tasks
 
-(session state persisted to Redmine #367/#368, Discourse audit #298 reply 51,
-Discourse k8s wiki #305 reply 8, and git PFVCluster d3c5ae8/1f44a19)
-
-- [x] k3s HA control plane rebuilt: 3/3 cnodes Ready, etcd quorum, taints [#367]
-- [x] Proxmox tuning applied (ssd/discard, queues=2, cpuunits, startup order) [#367]
-- [x] Founder moved cnode disks to TS5-SSD; etcd latency 4-5s → <1s [#367]
-- [x] Workers joined: tsys3/6/7/9 + ultix-streaming (replaces tsys5 slot) [#368]
-- [x] Serial bounce wave completed; test pod schedules on worker only [#368]
-- [x] post-setup.sh kubectl bug + join-workers.sh timeouts fixed; tuning codified [#367][#368]
-- [x] ultix-offstage excluded (unreachable) — join when back on tailnet [#368]
-- [x] hap-bridge removed from pfv-bms host (unsupported_system_software fixed; supported=true) [#619]
-- [x] hap-bridge.py merge fix + 5 unit tests (babd6d2) [#619]
-- [x] Core watchdog re-enabled (founder-approved); community SSH add-on confirmed gone [#344]
-- [x] Lock DHCP-table verdict: no lock OUIs, BLE-only likely — answered in needfromcharles §3 [#619]
-- [x] iDRAC probes: both live, TLS1.0-only, no Redfish (hardware gen), SNMP off — #625 note + creds ask §9
-- [x] HA backup pre-cleanup-2026-09-02 verified (692MB); image prune 0B (nothing dangling; 4GB optional via -a, left to founder)
+(none — sessions track their own state in .crush/active-ticket*; last
+completed: Kuma Cloudron coverage + root cleanup, #435)