feat(jmri): headless JMRI server with Leviton layout power monitor and X11 GUI mode

- Stable udev device symlinks (/dev/jmri/nce, /dev/jmri/loconet, /dev/jmri/lcc)
- jmri-monitor: polls Leviton Decora Smart switch to start/stop JMRI automatically
  - Quiet hours 1-10 AM (no polling)
  - 30s off-delay before shutdown
- LCRR config cloned from Gitea (ssh://gitea.mk-labs.cloud:2221/rblundon/LCRR.git)
- ~/.jmri symlinked to LCRR repo for GitOps config management
- jmri-gui: X11 remote GUI access (PanelPro/DecoderPro) via ssh -X as jmri user
  - Stops daemon, launches GUI, restarts daemon on exit if layout still on
- jmri user gets login shell + SSH key for GUI sessions
- Full JRE installed (openjdk-21-jre) for AWT/X11 support

ansible/roles/jmri/templates/99-jmri-devices.rules.j2

@@ -0,0 +1,25 @@
+# /etc/udev/rules.d/99-jmri-devices.rules
+# Managed by Ansible — do not edit manually.
+#
+# Creates stable /dev/jmri/* symlinks for all three JMRI serial interfaces.
+# Uses ID_SERIAL (full serial string) to match by-id symlink identity,
+# so device numbering (ttyACM0, ttyACM1, etc.) doesn't matter after reboots.
+# Ownership: root:dialout mode 0660 — jmri user is a member of dialout.
+
+# NCE command station (Microchip CDC)
+# Appears when layout is powered on; disappears when layout powers off.
+SUBSYSTEM=="tty", ENV{ID_SERIAL}=="{{ jmri_dev_nce_serial }}", \
+  SYMLINK+="jmri/nce", \
+  GROUP="dialout", MODE="0660"
+
+# RR-CirKits LocoBuffer-NG (LocoNet bridge)
+# USB-powered — always present when server is running.
+SUBSYSTEM=="tty", ENV{ID_SERIAL}=="{{ jmri_dev_loconet_serial }}", \
+  SYMLINK+="jmri/loconet", \
+  GROUP="dialout", MODE="0660"
+
+# FTDI USB serial (LCC interface)
+# USB-powered — always present when server is running.
+SUBSYSTEM=="tty", ENV{ID_SERIAL}=="{{ jmri_dev_lcc_serial }}", \
+  SYMLINK+="jmri/lcc", \
+  GROUP="dialout", MODE="0660"