feat(jmri): headless JMRI server with Leviton layout power monitor and X11 GUI mode

- Stable udev device symlinks (/dev/jmri/nce, /dev/jmri/loconet, /dev/jmri/lcc)
- jmri-monitor: polls Leviton Decora Smart switch to start/stop JMRI automatically
  - Quiet hours 1-10 AM (no polling)
  - 30s off-delay before shutdown
- LCRR config cloned from Gitea (ssh://gitea.mk-labs.cloud:2221/rblundon/LCRR.git)
- ~/.jmri symlinked to LCRR repo for GitOps config management
- jmri-gui: X11 remote GUI access (PanelPro/DecoderPro) via ssh -X as jmri user
  - Stops daemon, launches GUI, restarts daemon on exit if layout still on
- jmri user gets login shell + SSH key for GUI sessions
- Full JRE installed (openjdk-21-jre) for AWT/X11 support

cluster/platform/democratic-csi/values.yaml

@@ -0,0 +1,103 @@
+# ------------------------------------------------------------------------------
+# democratic-csi Helm Values for Pure FlashArray (utilidor)
+#
+# Backend: Pure Storage FlashArray via freenas-iscsi driver
+# Target: utilidor.local.mk-labs.cloud (10.1.71.5)
+# 
+# Note: The freenas-iscsi driver works with Pure API v2+ 
+# Pure FlashArray exposes an API compatible with FreeNAS/TrueNAS
+# ------------------------------------------------------------------------------
+
+csiDriver:
+  name: "org.democratic-csi.iscsi-pure"
+
+storageClasses:
+  - name: pure-iscsi-block
+    defaultClass: false
+    reclaimPolicy: Delete
+    volumeBindingMode: Immediate
+    allowVolumeExpansion: true
+    parameters:
+      fsType: ext4
+    mountOptions: []
+    secrets:
+      provisioner-secret:
+      controller-publish-secret:
+      node-stage-secret:
+      node-publish-secret:
+      controller-expand-secret:
+
+driver:
+  config:
+    driver: freenas-iscsi
+    instance_id: mk-labs-utilidor
+    
+    httpConnection:
+      protocol: https
+      host: utilidor.local.mk-labs.cloud
+      port: 443
+      # Pure API token from pure-exporter secret
+      apiKey: "6157dea0-4c0d-b14b-6e6a-453aa649355d"
+      allowInsecure: true
+      apiVersion: 2
+    
+    zfs:
+      # Pure volumes are created in a pod/volume group context
+      # This maps to Pure's volume naming scheme
+      datasetParentName: csi-volumes
+      detachedSnapshotsDatasetParentName: csi-snapshots
+      datasetEnableQuotas: false
+      datasetEnableReservation: false
+      datasetPermissionsMode: "0777"
+      datasetPermissionsUser: 0
+      datasetPermissionsGroup: 0
+    
+    iscsi:
+      targetPortal: "10.1.71.5:3260"
+      targetPortals: []
+      # Pure FlashArray iSCSI configuration
+      interface: default
+      namePrefix: "csi-"
+      nameSuffix: ""
+      targetGroups:
+        # Pure uses host groups for iSCSI targets
+        # Leave empty to auto-select
+      extentCommentTemplate: "Kubernetes CSI volume {{ parameters.[csi.storage.k8s.io/pvc/namespace] }}/{{ parameters.[csi.storage.k8s.io/pvc/name] }}"
+      extentInsecureTpc: true
+      extentXenCompat: false
+      extentDisablePhysicalBlocksize: true
+      extentBlocksize: 512
+      extentRpm: "SSD"
+      extentAvailThreshold: 0
+
+controller:
+  enabled: true
+  replicaCount: 3
+  strategy: deployment
+  priorityClassName: system-cluster-critical
+  
+  externalAttacher:
+    enabled: true
+  
+  externalProvisioner:
+    enabled: true
+  
+  externalResizer:
+    enabled: true
+  
+  externalSnapshotter:
+    enabled: false
+
+node:
+  enabled: true
+  rbac:
+    enabled: true
+  
+  driver:
+    logLevel: info
+  
+  # Talos requires hostNetwork for iSCSI operations
+  hostNetwork: true
+  hostIPC: true
+  
+  dnsPolicy: ClusterFirstWithHostNet