feat: Tailscale resolution hardening, partnership offboard completion, Emby provisioning

common.sh:
- Add resolve_tailscale_ip() helper — tries `tailscale ip -4` first, falls back to
  parsing `tailscale status` output; handles hosts where MagicDNS short-name resolution
  is not active
- Add PARTNERSHIP_OWN_CONTAINERS alias in detect_hosts()
- Add aliasing for 4 Emby provisioning vars (PARTNERSHIP_PROVISION_EMBY_ADMIN,
  PARTNERSHIP_EMBY_ADMIN_USER, PARTNERSHIP_EMBY_ADMIN_PASS, PARTNERSHIP_EMBY_PORT)

Partnership/partnership_manager.sh:
- Replace 9 bare `tailscale ip -4` calls with resolve_tailscale_ip()
- Add read_remote_conf_var() and read_remote_conf_array() — SSH to mirror, source its
  own load_config.sh + detect_hosts(), return aliased variable; solves sparse-checkout
  problem where HOST1 cannot read master_host2.conf directly
- Add derive_short_name() — strips unraid- prefix, capitalises first char
- Add cleanup_partner_containers() — removes partner containers via FolderView3 folder
  if enabled, else falls back to FALLBACK_*_COVERS_*_TIER* arrays
- Add cleanup_owner_containers_on_mirror() — SSH to mirror, stops and removes containers
  matching *-${OWNER_SHORT} naming convention
- Add start_own_stack() and start_mirror_own_stack() — restart own containers locally
  or on mirror via SSH using PARTNERSHIP_OWN_CONTAINERS
- Add provision_emby_admin() — reads mirror credentials via read_remote_conf_var, checks
  for username collision, creates user + sets password + grants admin policy via Emby API
- Add revoke_emby_admin() — looks up mirror username on local Emby, deletes via REST API
- Wire offboard paths (both mirror-initiated and owner-initiated) to call container
  cleanup and stack restart; update --check finalisation paths accordingly
- Fix write_state_file in --onboard not gated on DRY_RUN (was writing ACTIVE state on
  dry runs)

master_host1.conf:
- Add HOST1_PARTNERSHIP_OWN_CONTAINERS array
- Add partnership Emby provisioning config (toggle + port + per-host credentials)

master_host2.conf:
- Add HOST2_PARTNERSHIP_OWN_CONTAINERS array
- Add HOST2_PARTNERSHIP_EMBY_ADMIN_USER and HOST2_PARTNERSHIP_EMBY_ADMIN_PASS

Tailscale fix applied to:
- Initial_run/ssh_setup.sh (2 callsites)
- unRAID_Essentials/rsync_stop.sh (1 callsite)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

common.sh

@@ -374,6 +374,7 @@ validate_int() {
 #
 # Also sets aliases for all host-specific arrays so scripts use unprefixed names:
 #   DAILY_SYNC_SHARES         ← HOST*_DAILY_SYNC_SHARES
+#   INTERMEDIATE_SYNC_SHARES  ← HOST*_INTERMEDIATE_SYNC_SHARES
 #   WEEKLY_SYNC_SHARES        ← HOST*_WEEKLY_SYNC_SHARES
 #   CRITICAL_SYNC_SHARES      ← HOST*_CRITICAL_SYNC_SHARES
 #   DAILY_RESTART_CONTAINERS  ← HOST*_DAILY_RESTART_CONTAINERS
@@ -473,6 +474,16 @@ detect_hosts() {
     EMBY_API_KEY_VAR="${MY_ID}_EMBY_API_KEY"
     EMBY_API_KEY="${!EMBY_API_KEY_VAR:-}"
 
+    local _prov_var
+    for _prov_var in \
+        PARTNERSHIP_PROVISION_EMBY_ADMIN \
+        PARTNERSHIP_EMBY_ADMIN_USER \
+        PARTNERSHIP_EMBY_ADMIN_PASS \
+        PARTNERSHIP_EMBY_PORT; do
+        local _src="${MY_ID}_${_prov_var}"
+        printf -v "$_prov_var" '%s' "${!_src:-}"
+    done
+
     # ── System watchdog check toggles — per-host ─────────────────────────────
     # Aliased as unprefixed SYS_WATCHDOG_CHECK_* for use in system_watchdog.sh
     local _wd_checks=(
@@ -540,6 +551,7 @@ detect_hosts() {
 
     _alias_array "DAILY_SYNC_SHARES"
     _alias_array "PERSONAL_SHARES"
+    _alias_array "INTERMEDIATE_SYNC_SHARES"
     _alias_array "WEEKLY_SYNC_SHARES"
     _alias_array "CRITICAL_SYNC_SHARES"
     _alias_array "BACKUP_VERIFY_SHARES"
@@ -559,6 +571,7 @@ detect_hosts() {
     _alias_array "DDNS_CONTAINERS"
     _alias_array "PARTNERSHIP_AUTH_WEBUIS"
     _alias_array "PARTNERSHIP_MIRROR_BACKUPS"
+    _alias_array "PARTNERSHIP_OWN_CONTAINERS"
 
     # ── Set array aliases — associative arrays ────────────────────────────────
     # Associative arrays cannot be copied with eval — must be rebuilt key by key
@@ -610,6 +623,17 @@ resolve_remote_ip() {
     info "$ICON_NET Remote IP: $REMOTE_SERVER"
 }
 
+# Resolve any hostname to a Tailscale IPv4 — tries direct lookup, falls back to status parse.
+# Usage: ip=$(resolve_tailscale_ip "hostname") — returns empty string on failure.
+resolve_tailscale_ip() {
+    local hostname="${1,,}"
+    local ip
+    ip=$(tailscale ip -4 "$hostname" 2>/dev/null)
+    [[ -z "$ip" ]] && \
+        ip=$(tailscale status 2>/dev/null | awk -v name="$hostname" '$2 ~ "^" name { print $1; exit }')
+    echo "$ip"
+}
+
 # ==============================================================================================
 # ── CONNECTIVITY CHECKS ───────────────────────────────────────────────────────────────────────
 # ==============================================================================================
@@ -1455,7 +1479,7 @@ check_arr_version() {
     fi
 
     version=$(echo "$status_response" | \
-        grep -o '"version":"[^"]*"' | \
+        grep -o '"version": *"[^"]*"' | \
         grep -o '[0-9][^"]*' | head -1)
 
     if [[ -z "$version" ]]; then