GRE-224: install supervised appliance services

[HeadCase]

Summary

• install independently supervised ObsCam, MediaMTX, and media-network units with least-privilege device access
• pin and verify MediaMTX v1.19.3, bound service resources and logs, and add conflict-refusing appliance installation
• expose the three units through one operator-facing obscam.target while preserving independent crash recovery

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets --all-features
• cargo deny check
• cargo machete
• npm test
• npm run typecheck:browser
• staged clean-install/idempotency/conflict tests
• deployed Pi reboot, exact device permissions, target start/stop/restart, independent clean-exit/SIGKILL recovery, and full health restoration
• AllSky remained active and unchanged

Shellcheck was unavailable on the Pi; shell integration tests passed. No browser behavior changed, so graphical browser verification was not applicable.