feat: add lab-gated SSH command runner and templates

[Mr-Jerf]

Summary

Adds an administrator-only, lab-gated SSH command runner for registered devices,
with reusable command templates and durable per-run/per-device execution records.

What changed

• Adds a queued SSH command runner using My Mate's existing Rusted integration
• Adds admin-only command template CRUD and selector UI
• Requires explicit confirmation for every command run
• Requires exact template timestamp/hash confirmation before execution
• Runs one isolated job per selected device
• Adds bounded timeout, output, and error handling
• Adds durable command_runs and command_run_targets records
• Retains Redis only for live polling state
• Preserves existing backup workflows
• Adds focused feature coverage and migration/model coverage

Safety and scope

• Administrator-only command execution and template management
• Initial use is intended for read-only RouterOS commands
• No template variables or arbitrary scripts in this slice
• No credentials are stored in templates or run output
• Production activation is not included
• Lab deployment and customer traffic remain separate

Dependency

This branch consumes the Rusted execute API proposed in:

JoshFinlayAU/rusted#5

The production Dockerfile must be pinned to the immutable merged Rusted
revision before production use. The current lab image uses a local,
execute-enabled Rusted build only for isolated testing.

Verification

• Focused command/template suite: 12 tests / 54 assertions
• Complete Laravel suite: 66 tests / 2,656 assertions
• Frontend production build passes
• Rusted go test ./... passes
• Successful lab execution verified against Bellon-5009
• Durable successful run and target records verified
• Existing backup workflow verified after the integration

Review status

Please review the architecture, authorization boundaries, durable audit model,
queue behavior, and Rusted API contract. This draft should not be treated as
production approval; a clean pinned build and fresh release review are still
required.