fix(web): make machine setup usable through forwarded consoles

[sam2tom]

Machine management now distinguishes a failed console capability request from an explicitly unconfigured deployment and presents both in the existing console layout with a refresh action.

When the console is opened through a localhost SSH tunnel, Add node requires a non-loopback HTTPS address for the same console before issuing an enrollment token. Commands retain the deployment Core origin separately; an unusable Core origin is reported instead of generating a command. Normal HTTPS console access retains the one-click flow. Enrollment secrets remain transient and late responses are discarded after closing or changing connections.

Validation: TypeScript checks and Web production build passed; 409 client and 781 Web unit tests passed; 33 focused sandbox manager/setup browser tests passed. make check passed Console and installer/distribution checks, then stopped because PARSAR_AGENTS_API_TEST_DATABASE_URL was not set. No real node registration or deletion was performed. Independent blind review found no blocking issues; the reviewer also passed five focused browser regressions.

Deployments still need paired server-side administrator credentials and a matching node distribution payload served at /node-install/. The console URL used by the target host must actually serve that payload; an API-only origin is insufficient.

[sam2tom]

Closed by product decision. Future Core Console work follows #96; this standalone change is no longer needed.