fix(console): enable conmand remote access + add conman client script

conmand was binding to localhost only (server loopback=on default), so
the conman client on workstations couldn't connect. The intended workflow
is: conman client (workstation) → conmand (pfv-tsys4:7890 over Tailscale)
→ ser2net (TCP 2001-2007) → serial device. Without remote conmand access,
users had to telnet directly to ser2net, which conflicts with conmand's
persistent connections (kickolduser kicks the telnet session immediately).

Changes:
- generate-config.sh: add server loopback=off to conman.conf so conmand
  listens on 0.0.0.0:7890 (reachable via Tailscale)
- query-remote.sh: new script for workstations — installs conman client,
  verifies connectivity, lists or connects to consoles
- README.md: clarify access model (conman primary, telnet emergency only
  with conmand stopped). Document the kickolduser conflict.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

console/README.md

@@ -64,18 +64,30 @@ All ports listen on the Tailscale IP (`100.70.77.93`).
 
 ### Connect to a console
 
+**Primary method — conman client (with logging + multiplexing):**
+
 ```bash
-# Via conman (with logging + multiplexing):
-conman -f pfv-core-sw01        # attach to console
-conman -q                      # query status of all consoles
-
-# Via telnet (direct, no logging):
-telnet 100.70.77.93 2001       # pfv-core-sw01
-
-# From any Tailscale-connected device:
-telnet pfv-tsys4 2001
+# From any Tailscale-connected workstation:
+conman -d pfv-tsys4:7890 -f pfv-core-sw01     # connect to console
+conman -d pfv-tsys4:7890 -q                    # list all consoles
 ```
 
+Escape sequence: `&.` to disconnect, `&?` for help.
+
+**Direct telnet (emergency only — conflicts with conman):**
+
+```bash
+# Direct telnet to ser2net works ONLY when conmand is stopped, because
+# conmand maintains persistent connections to all 7 TCP ports. Use:
+ssh pfv-tsys4 'systemctl stop conmand'
+telnet pfv-tsys4 2001                          # pfv-core-sw01
+ssh pfv-tsys4 'systemctl start conmand'        # restart when done
+```
+
+**Do NOT use telnet while conmand is running** — conmand will reconnect
+and kick your telnet session immediately ("Connection closed by foreign host").
+The correct workflow is conman client → conmand → ser2net → device.
+
 ### Re-deploy after changing mapping.txt
 
 ```bash

console/generate-config.sh

@@ -193,6 +193,12 @@ if ! grep -qiE '^\s*server\s+logdir\s*=' "$CONMAN_CONF" 2>/dev/null; then
   echo "  Added server logdir = \"$CONMAN_LOGDIR\" to $CONMAN_CONF"
 fi
 
+# Ensure loopback=off so conmand is reachable over Tailscale (not localhost-only)
+if ! grep -qiE '^\s*server\s+loopback\s*=' "$CONMAN_CONF" 2>/dev/null; then
+  sed -i "/^server logdir/a server loopback=off" "$CONMAN_CONF"
+  echo "  Added server loopback=off to $CONMAN_CONF (enables remote access)"
+fi
+
 # Remove any previous auto-generated block (between markers)
 # Then append the new block
 MARKER_BEGIN="# BEGIN PFV CONSOLE DEFINITIONS (auto-generated — do not edit between markers)"

console/query-remote.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/bash
+#
+# console/query-remote.sh — install conman client and connect to a console
+# on pfv-tsys4 over Tailscale.
+#
+# Usage:
+#   bash console/query-remote.sh                    # list consoles
+#   bash console/query-remote.sh pfv-core-sw01      # connect to a console
+#
+set -euo pipefail
+
+REMOTE_HOST="${REMOTE_HOST:-pfv-tsys4}"
+REMOTE_PORT="${REMOTE_PORT:-7890}"
+
+echo "============================================"
+echo "  Conman Remote Console Access"
+echo "  Server: ${REMOTE_HOST}:${REMOTE_PORT} (Tailscale)"
+echo "============================================"
+
+# --- 1. Install conman client if missing ---
+if ! command -v conman >/dev/null 2>&1; then
+  echo ""
+  echo "--- Installing conman client ---"
+  if sudo -n true 2>/dev/null; then
+    sudo apt-get update -qq && sudo apt-get install -y -qq conman
+  else
+    echo "  Passwordless sudo not available. Please run:"
+    echo "    sudo apt-get update && sudo apt-get install -y conman"
+    echo "  Then re-run this script."
+    exit 1
+  fi
+else
+  echo "  conman client already installed."
+fi
+
+# --- 2. Verify connectivity ---
+echo ""
+echo "--- Connectivity check ---"
+if timeout 3 bash -c "echo > /dev/tcp/${REMOTE_HOST}/${REMOTE_PORT}" 2>/dev/null; then
+  echo "  [OK] ${REMOTE_HOST}:${REMOTE_PORT} reachable"
+else
+  echo "  [FAIL] Cannot reach ${REMOTE_HOST}:${REMOTE_PORT}"
+  echo "  Is Tailscale up? Is conmand running on ${REMOTE_HOST}?"
+  exit 1
+fi
+
+# --- 3. List or connect ---
+CONSOLE="${1:-}"
+if [ -z "$CONSOLE" ]; then
+  echo ""
+  echo "--- Available consoles ---"
+  conman -d "${REMOTE_HOST}:${REMOTE_PORT}" -q
+  echo ""
+  echo "To connect: bash $0 <console-name>"
+  echo "  e.g: bash $0 pfv-core-sw01"
+else
+  echo ""
+  echo "--- Connecting to: $CONSOLE ---"
+  echo "  Escape sequence: &. (to disconnect)"
+  echo ""
+  conman -d "${REMOTE_HOST}:${REMOTE_PORT}" -f "$CONSOLE"
+fi