Instances: embed Tailcat forward status + probe diagnostics on federated peer cards

[atomanticagent]

Problem

Operator can see a Tailcat Forwards row green running (127.0.0.1:15555 -> :5555) while the Federated peer card for the same peer is offline / probe failures (Last seen never, consecutive failures). Two surfaces disagree, and there is no operator-visible classification of why the health probe failed.

Wanted

1. Move forward status onto the federated peer card when transport === 'tailcat' (mapping, live/running/no-route/failed, tunnelError, Retry / Forget). Demote standalone Tailcat Forwards panel to orphans / pre-peer failures only.
2. Health check control on the peer card forcing an immediate probe; show last probe result (classified error, HTTP status, latency, timestamp, nextProbeAt).
3. Structured diagnostics (API + logs) distinguishing:
   • local connection refused (forward not listening)
   • tunnel dial failure (tunnelError path)
   • tunnel OK but /api/system/health/details probe failure
4. Never expose full tc… addresses — redact like existing code.

Context

Follows #6401 and #6471 (tunnelError / tunnelErrorAt on forwards).