doc audit — fix stale watchdog vars, fallback_state_reset, add monthly_maintenance and mesh_monitor sections

- Tools/Manual-Tools.md: fallback_state_reset.sh marked not yet built; manual
  workaround added; TOC entry updated; failover→fallback rename throughout
- Watchdogs/Manual-Watchdogs.md: System Watchdog config block updated — remove
  pre-split vars (MEM_WARN_GB, MEM_SHUTDOWN_GB, MEM_GB, MEM_RECOVER_GB,
  SYS_WATCHDOG_MEM_SHUTDOWN_EXCLUDED, SYS_WATCHDOG_REQUIRED_CONTAINERS);
  add SYS_WATCHDOG_MEM_GB (reboot trigger only); fix state file path names
  (watchdog_state.db → container_watchdog_state.db,
  sys_watchdog_state.db → system_watchdog_state.db)
- Orchestrators/README-Orchestrators.md: add monthly_maintenance.sh section
  with two-gate model, configuration reference, and usage examples
- Monitors/README-Monitors.md: add mesh_monitor.sh to both tables and diagram
- Monitors/Manual-Monitors.md: add mesh_monitor.sh section
- README-User_Script_Plug-in.md, Rsync/README-Rsync.md, Rsync/Manual-Rsync.md,
  README.md: emby-failover → emby-fallback (missed from prior batch)

Monitors/Manual-Monitors.md

@@ -343,6 +343,45 @@ long-term history. It avoids flash drive writes entirely.
 
 ---
 
+## ━━━ MESH MONITOR ━━━
+
+At-a-glance view of the mesh — who the members are, what each node covers for the
+others when they go down, and the current partnership state. Read-only. Parses conf
+files directly — no SSH, no API calls, no sensitive data.
+
+### Sections
+
+```
+MEMBERS     — server name, owner, contact email for each HOST*
+COVERAGE    — what each host covers for others, by tier
+PARTNERSHIP — enabled/disabled, current owner, sync interval
+```
+
+### When to Use
+
+```
+Onboarding a new mesh member — paste the output to show them the current topology
+After adding a new container to a fallback tier — verify it appears in the right tier
+When troubleshooting fallback — confirm coverage arrays are configured correctly
+```
+
+### Usage
+
+```bash
+mesh_monitor.sh           # full mesh overview
+mesh_monitor.sh --log     # verbose output
+mesh_monitor.sh --status  # show config and exit
+```
+
+### Configuration
+
+No dedicated config keys. Reads `HOST*_OWNER`, `HOST*_OWNER_EMAIL`, and
+`FALLBACK_HOST*_COVERS_HOST*_TIER*` arrays from `host*.conf`. Scales automatically
+as new nodes join — add a new `HOST3_*` block and it appears in output without
+changing the script.
+
+---
+
 ## ━━━ FULL CONFIGURATION REFERENCE ━━━
 
 ### master.conf

Monitors/README-Monitors.md

@@ -108,6 +108,7 @@ folder is designed with this constraint in mind.
 | `weekly_health_digest.sh` | Never | reads existing state files only |
 | `bandwidth_monitor.sh` | One append + one trim per rsync run | Bounded — never exceeds `BANDWIDTH_LOG_RETENTION` lines |
 | `system_tuning_monitor.sh` | One append + one trim every 6 hours | Bounded — trimmed to `TUNING_LOG_RETENTION` days |
+| `mesh_monitor.sh` | Never | read-only conf parse — no API calls, no SSH |
 
 ---
 
@@ -123,6 +124,7 @@ folder is designed with this constraint in mind.
 | `bandwidth_monitor.sh` | rsync transfer history and trends | Auto (called by rsync.sh) + weekly report Sunday 11am |
 | `weekly_health_digest.sh` | Full ecosystem health aggregation | Daily 8am (DIGEST_PROFILE controls notify) |
 | `system_tuning_monitor.sh` | inotify + PHP-FPM utilisation trends | Every 6 hours |
+| `mesh_monitor.sh` | Mesh membership — who covers whom, partnership state | On demand |
 
 ---
 
@@ -143,6 +145,10 @@ Sunday morning block (after nightly maintenance):
 Every 6h:
   system_tuning_monitor.sh ──────────────────► TUNING_MONITOR_LOG
 
+On demand:
+  mesh_monitor.sh ──────────────────────────── reads host*.conf only (no API, no SSH)
+                                                MEMBERS / COVERAGE / PARTNERSHIP sections
+
 Daily 8am:
   weekly_health_digest.sh ── reads ──────────► FALLBACK_STATE_FILE
                           ── reads ──────────► WATCHDOG_STATE_FILE