v46.1-ui-mt76: Argon theme + hardened WG tunnel + Link Health dashboard

基于 v46 正式版(mt76)只恢复 UI 层:
- luci-theme-argon 2.4.3: local-background-wins 登录页 + bg1.jpg fallback
- luci-app-argon-config: 去 ui.changes.apply, ACL mutator 移 write
- luci-app-wgtunnel: rpcd ucode 后端(get/status/prepare/apply/rollback/reconnect),
  JSONMap 前端, 60s 一次性 token, 快照回滚, 无全局 network ACL
- luci-app-tr3000-status: 只读 rpcd ucode + 5s 轮询仪表盘
- tools/: audit_ui_packages.py + install_preview.sh + rollback_watchdog.sh
- docs/: 开发经历与翻车记录 + 固件哈希记录

固件本体(含烤入 WG 私钥/PSK)不入 git, 仅 K 盘保存.
kernel 成员与 v46 byte-identical; 尚未刷机.

immortalwrt-patches/feeds/luci/applications/luci-app-tr3000-status/tests/rollback_preview.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Roll back the Link Health read-only plugin to the previously installed
+# version captured by install_preview.sh. Strictly UI-only.
+
+set -euo pipefail
+
+PKG_NAME="luci-app-tr3000-status"
+ROUTER="${ROUTER:-root@192.168.1.2}"
+BACKUP_ROOT="/root/.v46.1-preview/luci-app-tr3000-status"
+BACKUP_DIR="${1:?usage: rollback_preview.sh <backup_timestamp_dir>}"
+
+echo "[info] rolling back from $BACKUP_ROOT/$BACKUP_DIR"
+ssh -o BatchMode=yes "$ROUTER" "set -e
+if [ -f '$BACKUP_ROOT/$BACKUP_DIR/prev_version' ]; then
+  PKG_VERSION=\"\$(cat '$BACKUP_ROOT/$BACKUP_DIR/prev_version')\"
+  echo \"[info] previous package version: \$PKG_VERSION\"
+  if [ -n \"\$PKG_VERSION\" ]; then
+    opkg install --force-reinstall --downgrade '$PKG_NAME'=\"\$PKG_VERSION\" || true
+  fi
+else
+  echo '[warn] no prev_version file; will remove package only'
+  opkg remove '$PKG_NAME' || true
+fi
+/etc/init.d/rpcd restart
+/etc/init.d/uhttpd restart >/dev/null 2>&1 || true
+echo '[ok] rolled back'
+"