regions: config switch regions.enabled to turn off Regions background work per instance (default on) #518

Problem

The Regions views (#501–#510) add background work and memory on every instance:

• Every 5 minutes the relay snapshot also builds the Regions history (504 hourly buckets per relay and scope), directed routes and scope pairs, per-observation evidence cells and membership/path capture.
• Measured on staging, RSS is about +150–300 MB. /api/regions/history is 1.1 MB raw and /api/regions/routes is 5.4 MB raw per request.

Small hosts, such as meshview.dk with 3.7 GiB RAM shared with other services, should be able to turn this off.

Design (owner decision 2026-10-21)

1. Config key regions.enabled (bool). Default true, so behaviour does not change on upgrade. It is read at startup and needs a restart; SIGHUP does not reload it. Document it in config.example.json and docs/.
2. When false:
   • Skip only the Regions-specific builders in the relay snapshot pass: history buckets, route/step collector, membership/path capture and evidence cells. The existing relay/liveness/enrichment data that other views use must stay unchanged.
   • /api/regions/observed|history|routes return a typed, cheap response such as {"enabled": false} (named Go struct, no new map[string]interface{}) and do no work.
   • The client config (/api/config/client) exposes the flag. The UI hides Regions from the top nav and the mobile More sheet; the Regions reachable from the mobile More sheet #455 guard test must allow this, as it already does for opt-in routes. A direct visit to #/regions shows "Regions is disabled by the instance operator".
3. When true: behaviour is byte-identical to today.

Tests and evidence

• Disabled: a counter or seam proves the Regions builders do not run; the endpoints return the disabled shape; the nav entries are hidden on desktop and mobile; the direct route shows the message.
• Enabled: existing Regions tests are unchanged and green.
• Measure retained memory and the snapshot pass time with the flag on and off on a realistic fixture, and report both.
• The perf(store): move runtime SQL outside packet-store locks #495 lock rule holds.