fix(console): enable conmand remote access + add conman client script

conmand was binding to localhost only (server loopback=on default), so
the conman client on workstations couldn't connect. The intended workflow
is: conman client (workstation) → conmand (pfv-tsys4:7890 over Tailscale)
→ ser2net (TCP 2001-2007) → serial device. Without remote conmand access,
users had to telnet directly to ser2net, which conflicts with conmand's
persistent connections (kickolduser kicks the telnet session immediately).

Changes:
- generate-config.sh: add server loopback=off to conman.conf so conmand
  listens on 0.0.0.0:7890 (reachable via Tailscale)
- query-remote.sh: new script for workstations — installs conman client,
  verifies connectivity, lists or connects to consoles
- README.md: clarify access model (conman primary, telnet emergency only
  with conmand stopped). Document the kickolduser conflict.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

console/generate-config.sh

@@ -193,6 +193,12 @@ if ! grep -qiE '^\s*server\s+logdir\s*=' "$CONMAN_CONF" 2>/dev/null; then
   echo "  Added server logdir = \"$CONMAN_LOGDIR\" to $CONMAN_CONF"
 fi
 
+# Ensure loopback=off so conmand is reachable over Tailscale (not localhost-only)
+if ! grep -qiE '^\s*server\s+loopback\s*=' "$CONMAN_CONF" 2>/dev/null; then
+  sed -i "/^server logdir/a server loopback=off" "$CONMAN_CONF"
+  echo "  Added server loopback=off to $CONMAN_CONF (enables remote access)"
+fi
+
 # Remove any previous auto-generated block (between markers)
 # Then append the new block
 MARKER_BEGIN="# BEGIN PFV CONSOLE DEFINITIONS (auto-generated — do not edit between markers)"