mbproxy: fix the dashboard's C2/M-series review findings

Closes the on-demand-capture leak cluster from the code review. The capture's armed state was driven off SignalR's ConnectionId, which changes on every transport reconnect, so a reconnect-during-view leaked a subscriber and left the capture armed forever with no viewer. PlcSubscriptionTracker now keys on a stable per-page-load tabId, and StatusBroadcaster reconciles capture arm state from the live viewer set each push cycle — making arming single-threaded and reconnect-safe. Also fixes the TagValueCapture disarm-vs-record race, the bind-failure broadcaster/listener leak, removes dead JSON-context code, and reworks the frontend cold-start retry plus an unknown-PLC watchdog. Adds tracker / broadcaster-loop / race / wire-shape test coverage.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

mbproxy/src/Mbproxy/Admin/StatusBroadcaster.cs

@@ -94,7 +94,13 @@ internal sealed class StatusBroadcaster : IAsyncDisposable
             _logger.LogError(ex, "StatusBroadcaster: fleet push failed");
         }
 
-        foreach (var plcName in _tracker.ActivePlcs())
+        // Reconcile capture arm state from the live viewer set. This is the single
+        // arm/disarm authority — doing it here (one thread, every cycle) means a SignalR
+        // reconnect or a hot-reload capture rebuild can never strand a capture armed.
+        var activePlcs = _tracker.ActivePlcs();
+        _captureRegistry.ReconcileArmed(activePlcs);
+
+        foreach (var plcName in activePlcs)
         {
             try
             {