feat(sentinèlla): p2p topology with DNS peer discovery

- Replace central sentinel with watcher: each node polls peers discovered
  via a single DNS name with multiple A records (e.g. peers.sentinella.com)
- Auto-detect own IPs via hostname -I; SELF env var available as optional
  override for NAT/floating-IP setups
- Fix Basic Auth bug in router.sh: compare tok against AUTH_TOKENS instead
  of unset $USER/$PASS
- Rename sentinel binary to watcher; drop unused shellplot dep
- Add inetutils to watcher runtime deps for hostname -I
- Update NixOS module: replace sentinel options with watcher p2p options
  (peersDns, self, peersPort, peersScheme, pollingIntervalSec)
- Add sentinèlla test suite: probe-status-empty, probe-disk, watcher-state-file

test/package/sentinèlla/launch.sh

@@ -0,0 +1,45 @@
+#!/bin/dash
+# launch.sh — sets up helpers and runs the test pointed to by $test
+
+# assert_eq(label, got, expected)
+assert_eq() {
+  label=${1:?}
+  got=${2:?}
+  expected=${3:?}
+  if [ "$got" != "$expected" ]; then
+    log error "FAIL: $label"
+    log error "  expected: $WHITE$expected"
+    log error "  got:      $WHITE$got"
+    exit 1
+  fi
+  log info "PASS: $label"
+}
+
+# assert_file_contains(label, file, pattern)
+assert_file_contains() {
+  label=${1:?}
+  file=${2:?}
+  pattern=${3:?}
+  if ! grep -q "$pattern" "$file" 2>/dev/null; then
+    log error "FAIL: $label — pattern '$pattern' not found in $file"
+    exit 1
+  fi
+  log info "PASS: $label"
+}
+
+# wait_for_file(file, timeout_sec)
+wait_for_file() {
+  file=${1:?}
+  timeout=${2:-10}
+  i=0
+  while [ $i -lt "$timeout" ]; do
+    [ -f "$file" ] && return 0
+    sleep 1
+    i=$((i+1))
+  done
+  log error "timeout waiting for file: $file"
+  exit 1
+}
+
+# run the actual test
+. "$test/run.sh"