Auth stack certs tab, arrs db fallbacks, cert monitor cache, conf parser fix

- Auth stack: fold cert monitor into Auth Stack page as fourth tab (Certs);
  remove standalone cert page and top-level tab
- cert_monitor.sh: write JSON status cache to State_Files/cert_status.json
  after each run; expose per-domain days/expiry via _CERT_DAYS/_CERT_EXPIRY globals
- api/cert.php: new — serves cached cert status; falls back to configured
  domains as UNKN when no cache exists; POST action=run triggers live check
- arrs db fallbacks: vv_arr_cleanup_stats/discovery_stats/recovery_stats now
  read from data/*.db files when log JSON files don't yet exist
- config.php vv_conf_vars(): unescape bash \$ → $ so passwords with dollar
  signs read correctly from conf files
- host1.conf: fill in HOST1_NPM_USER/PASS and HOST1_LLDAP_USER/PASS
- Partnership adapter pattern: Unraid-specific container logic extracted to
  Plugin/unraid/Partnership/; platform-agnostic structure stays in Partnership/
- First-run wizard: uniform multi-step flow for all hosts; HOST2 pull moved
  to checklist; auto SSH keygen and API key creation on save
- api/checklist.php: live setup checklist with pull_master action
- Fullscreen toggle: hide Unraid header/menu; state persists via localStorage

Partnership/ssh_setup.sh

@@ -45,14 +45,16 @@ source "$SCRIPTS_ROOT/load_config.sh"
 # ── Parse --force before parse_args ───────────────────────────────────────────────────────────
 MODE="setup"
 FORCE=false
+LOCAL_ONLY=false
 FILTERED_ARGS=()
 
 for arg in "$@"; do
     case "$arg" in
-        --force)    FORCE=true ;;
-        --validate) MODE="validate" ;;
-        --status)   MODE="status" ;;
-        *)          FILTERED_ARGS+=("$arg") ;;
+        --force)      FORCE=true ;;
+        --validate)   MODE="validate" ;;
+        --status)     MODE="status" ;;
+        --local-only) LOCAL_ONLY=true ;;
+        *)            FILTERED_ARGS+=("$arg") ;;
     esac
 done
 
@@ -325,6 +327,19 @@ else
 fi
 
 # ── Copy to remote ────────────────────────────────────────────────────────────────────────────
+if [[ "$LOCAL_ONLY" == true ]]; then
+    echo ""
+    echo "━━━━━ $ICON_SUMMARY SSH SETUP SUMMARY (local) ━━━━━"
+    echo "  Key:    $SSH_KEY_PATH"
+    echo "  Pubkey: $SSH_PUB_PATH"
+    echo "  Conf:   ${KEY_CONF_VAR} in host${HOST_NUM}.conf"
+    echo ""
+    warn "Local setup complete — copy public key to remote manually:"
+    warn "  ssh-copy-id -i $SSH_PUB_PATH root@<remote>"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━"
+    exit 0
+fi
+
 echo ""
 echo "━━━ $ICON_NET Copy Public Key to Remote ($REMOTE_SERVER_NAME) ━━━"
 
@@ -356,7 +371,6 @@ echo "━━━ $ICON_VERIFY Verify SSH Auth ━━━"
 if [[ "$DRY_RUN" == false ]]; then
     if test_ssh_auth "$REMOTE_SERVER"; then
         echo "SSH auth to $REMOTE_SERVER_NAME working ✅"
-        # Reset any existing strikes
         if [[ -f "$SSH_STRIKE_FILE" ]]; then
             write_strike_file 0 "" "$(date '+%Y-%m-%d %H:%M:%S')"
         fi