feat(jmri): headless JMRI server with Leviton layout power monitor and X11 GUI mode

- Stable udev device symlinks (/dev/jmri/nce, /dev/jmri/loconet, /dev/jmri/lcc)
- jmri-monitor: polls Leviton Decora Smart switch to start/stop JMRI automatically
  - Quiet hours 1-10 AM (no polling)
  - 30s off-delay before shutdown
- LCRR config cloned from Gitea (ssh://gitea.mk-labs.cloud:2221/rblundon/LCRR.git)
- ~/.jmri symlinked to LCRR repo for GitOps config management
- jmri-gui: X11 remote GUI access (PanelPro/DecoderPro) via ssh -X as jmri user
  - Stops daemon, launches GUI, restarts daemon on exit if layout still on
- jmri user gets login shell + SSH key for GUI sessions
- Full JRE installed (openjdk-21-jre) for AWT/X11 support

ansible/roles/jmri/templates/jmri.service.j2

@@ -1,26 +1,21 @@
 [Unit]
 Description=JMRI Server (JmriFaceless)
 Documentation=https://www.jmri.org/
-After=network.target
-# Give USB devices time to enumerate after boot
-After=dev-{{ jmri_serial_device | basename }}.device
-Wants=dev-{{ jmri_serial_device | basename }}.device
+# jmri-monitor starts and stops this service based on LocoNet traffic.
+# Do NOT enable this unit directly — it is managed by jmri-monitor.service.
+After=network.target systemd-udev-settle.service
 
 [Service]
 Type=simple
 User={{ jmri_user }}
 Group={{ jmri_group }}
 WorkingDirectory={{ jmri_install_dir }}
-
-# JmriFaceless requires a profile ID
-# Find yours: ls ~/.jmri/profiles/
 ExecStart={{ jmri_install_dir }}/JmriFaceless --profile={{ jmri_profile_id }}
 
-# Restart on failure, not on clean exit (e.g. intentional shutdown from Jython)
-Restart=on-failure
-RestartSec=10
+# Monitor owns lifecycle — do not auto-restart
+Restart=no
 
-# Give hardware time to settle before retry
+# Give hardware time to settle on start
 TimeoutStartSec=30
 
 # Logging — view with: journalctl -u jmri -f
@@ -32,4 +27,5 @@ SyslogIdentifier=jmri
 SupplementaryGroups=dialout
 
 [Install]
-WantedBy=multi-user.target
+# Intentionally no WantedBy — started only by jmri-monitor
+WantedBy=