Provision IP check observers and dark-launch controls

[Svaag]

Summary

• provision dual-stack HTTPS observers with tightly scoped Caddy routing
• delegate a dedicated DNS-check zone and forward privacy-bounded Knot dnstap observations
• add STUN-only coturn service, firewall/NAT flows, and RFC 5389 monitoring
• add Vault-backed Cloud/Web configuration for IP checks and paid IP quality
• keep both products dark by default and document staged rollout and rollback

Why

The agent-first network check needs independently observed IPv4, IPv6, DNS, and STUN signals while retaining strict privacy boundaries and an operator-controlled launch gate.

Impact and rollout

• adds v4.check.hyrule.host, v6.check.hyrule.host, stun.check.hyrule.host, and delegated dns.check.hyrule.host
• opens TCP/UDP 3478 only for STUN binding; relay, TURN authentication, TLS, DTLS, and CLI are disabled
• DNS observer accepts only scoped random labels and sends HMAC-authenticated, short-lived observations
• apply through the new ip-check-observer workflow option after secrets and application deployments are ready

Companion PRs

• Add agent-first IP quality and fingerprinting hyrule-cloud#73
• Add agentic IP check experience hyrule-web#38

Validation

• scripts/ci/iac-static.sh — 136 tests passed
• all six authoritative DNS zones validated
• deploy preflight passed
• git diff --check origin/main...HEAD

Runner advisories remain for target-only systemd binaries, the custom Caddy RFC2136 module, and privileged nftables validation.