feat: Tailscale resolution hardening, partnership offboard completion, Emby provisioning

common.sh:
- Add resolve_tailscale_ip() helper — tries `tailscale ip -4` first, falls back to
  parsing `tailscale status` output; handles hosts where MagicDNS short-name resolution
  is not active
- Add PARTNERSHIP_OWN_CONTAINERS alias in detect_hosts()
- Add aliasing for 4 Emby provisioning vars (PARTNERSHIP_PROVISION_EMBY_ADMIN,
  PARTNERSHIP_EMBY_ADMIN_USER, PARTNERSHIP_EMBY_ADMIN_PASS, PARTNERSHIP_EMBY_PORT)

Partnership/partnership_manager.sh:
- Replace 9 bare `tailscale ip -4` calls with resolve_tailscale_ip()
- Add read_remote_conf_var() and read_remote_conf_array() — SSH to mirror, source its
  own load_config.sh + detect_hosts(), return aliased variable; solves sparse-checkout
  problem where HOST1 cannot read master_host2.conf directly
- Add derive_short_name() — strips unraid- prefix, capitalises first char
- Add cleanup_partner_containers() — removes partner containers via FolderView3 folder
  if enabled, else falls back to FALLBACK_*_COVERS_*_TIER* arrays
- Add cleanup_owner_containers_on_mirror() — SSH to mirror, stops and removes containers
  matching *-${OWNER_SHORT} naming convention
- Add start_own_stack() and start_mirror_own_stack() — restart own containers locally
  or on mirror via SSH using PARTNERSHIP_OWN_CONTAINERS
- Add provision_emby_admin() — reads mirror credentials via read_remote_conf_var, checks
  for username collision, creates user + sets password + grants admin policy via Emby API
- Add revoke_emby_admin() — looks up mirror username on local Emby, deletes via REST API
- Wire offboard paths (both mirror-initiated and owner-initiated) to call container
  cleanup and stack restart; update --check finalisation paths accordingly
- Fix write_state_file in --onboard not gated on DRY_RUN (was writing ACTIVE state on
  dry runs)

master_host1.conf:
- Add HOST1_PARTNERSHIP_OWN_CONTAINERS array
- Add partnership Emby provisioning config (toggle + port + per-host credentials)

master_host2.conf:
- Add HOST2_PARTNERSHIP_OWN_CONTAINERS array
- Add HOST2_PARTNERSHIP_EMBY_ADMIN_USER and HOST2_PARTNERSHIP_EMBY_ADMIN_PASS

Tailscale fix applied to:
- Initial_run/ssh_setup.sh (2 callsites)
- unRAID_Essentials/rsync_stop.sh (1 callsite)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

master_host2.conf

@@ -105,6 +105,18 @@
         # fill in when HOST2 is back online
     )
 
+# Containers parked on this server when partnership is active.
+# Stopped on onboard (owner deploys its stack instead), restarted on offboard.
+    HOST2_PARTNERSHIP_OWN_CONTAINERS=(
+        # "Emby"
+        # "NginxProxyManager"
+    )
+
+# This server's desired Emby admin account on the shared Emby instance.
+# Set these — owner reads them during --onboard to create the account.
+    HOST2_PARTNERSHIP_EMBY_ADMIN_USER=""            # desired Emby username
+    HOST2_PARTNERSHIP_EMBY_ADMIN_PASS=""            # desired Emby password
+
 # ==============================================================================================
 # ── RSYNC ─────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
@@ -152,6 +164,15 @@
         # "/mnt/user/appdata-Fallback/Critical-Data"
     )
 
+# ━━━ Intermediate Sync Shares ━━━
+# Shares synced every 4 hours by intermediate_sync_maintenance.sh.
+# Uses DEFAULT_RSYNC_OPTS (no --delete) — for sub-daily propagation of metadata or watch state.
+# Full media share sync stays in the daily window. Leave empty to skip mid-day rsync entirely.
+    HOST2_INTERMEDIATE_SYNC_SHARES=(
+        # fill in when HOST2 is back online
+        # Example: "/mnt/user/Emby_Metadata"
+    )
+
 # ━━━ Critical Sync Shares ━━━
 # Appdata shares synced every 15 minutes by critical_sync_maintenance.sh.
 # Format: "/path/to/share" or "/path/to/share|profile-name"