feat: startup environment check + self-heal (v1.3)

- env_check(): verifies daemon/pineapd/UCI/monitors/recon DB, auto-fixes
  fixable issues and re-verifies; forces runtime SSID-pool broadcast off to
  match the UI (kills the 'pool on but UI shows off' gap)
- server.py --env-check CLI; payload.sh runs it verbosely before starting,
  aborts on core failure
- serve() runs the check at every startup (boot + procd respawn)
- /api/health exposes env report + pool_runtime; /api/recon/status exposes
  wlan0_pinned (2.4GHz under-sampling warning); recon page warns when a
  radio0 AP pins wlan0mon
- recon start failures now include the daemon reason in the UI error
- shared stabilization refactor (_stabilize_uci/PINEAPD_SAFE_UCI/_raise_monitors)
- tests: test_env_check.py (18) + health/recon updates

payload/user/remote_access/pager-webui/www/js/app.js

@@ -516,6 +516,9 @@ const Live = (() => {
         if (h.pineap_up === false) {
           el.textContent = 'PINEAPD DOWN';
           el.className = 'health-chip bad';
+        } else if (h.env && h.env.overall === 'fail') {
+          el.textContent = 'ENV CHECK FAIL';
+          el.className = 'health-chip bad';
         } else if (h.pool_disabled) {
           el.textContent = 'POOL OFF';
           el.className = 'health-chip warn';