feat(agent): lldpd physical-port binding at install + bridge-only hint

[gnacho]

Problem (#1369)

On OpenWrt (verified on qualcommax/ipq807x with nss-dp; DSA likely affected too), an lldpd bound to the bridge - the stock br-lan config after opkg install lldpd - reports zero neighbors forever: LLDP frames never reach a listener on the bridge master, and topology silently falls back to FDB inference with no warning anywhere.

Changes

• install-agent.sh: when lldpd is already installed, ensure it listens on physical ports (lan*,wan via UCI) and restart it. Idempotent: a binding that already includes physical ports is left untouched. The script never installs lldpd itself - installing packages stays the admin's call.
• Agent probe: on an honest zero-neighbor round with a bridge-only UCI binding, the payload carries lldp.hint="lldpd-bridge-only". UCI is only queried on empty rounds, so no extra fork when neighbors exist. New LldpdBridgeOnly parser with 9 table tests.
• Server: propagates it as router.lldpHint (recycled with the cache like the neighbors).
• UI: RouterDetail shows a warning banner with the exact fix command (i18n es/en).
• Docs: binding requirement next to the agent LLDP section in AGENTE-OPENWRT.md.

Verification

• Agent suite OK (incl. new table test); server suites adapters/httpapi/agentbin OK; vite build OK; eslint/tsc 0.
• Installer detection path verified read-only against the real fleet: rt3/rt4 already bind lan*,wan, so the new block would report "already physical" and touch nothing.
• Live preview E2E (Playwright, API interception injecting the hint): banner renders on the router page in Spanish with the fix command; no banner on units without the hint (negative control). EN/ES locale keys validated.

Closes #1369