Add office Raspberry Pi as remote Z-Wave JS radio host

## Goal

Use the existing office Raspberry Pi and Aeotec USB controller as a dedicated Z-Wave radio host while keeping Home Assistant as the automation, entity, dashboard, and policy controller.

## Verified hardware

- Aeotec Z-Stick Gen5 / ZW090 family
- USB identifier: `0658:0200`
- Linux serial device: `/dev/ttyACM0`
- 500-series Z-Wave Plus controller supported by Z-Wave JS
- The adapter exposes no unique USB serial string, so it does not receive a `/dev/serial/by-id` path
- A stable physical-port path is available under `/dev/serial/by-path`

## Intended architecture

`Aeotec Z-Stick -> Z-Wave JS UI on office Pi -> secure LAN WebSocket -> Home Assistant Z-Wave integration`

The Pi owns only the USB radio driver and Z-Wave server. Home Assistant remains the system of record and the only automation brain.

## Prerequisite

- [ ] Complete #1936 and prove the Pi and attached USB devices are electrically stable before starting this deployment.

## Implementation checklist

- [ ] Confirm whether the physical unit is the original Gen5 or Gen5+ and record its firmware/SDK version.
- [ ] Deploy a maintained ARMv7-compatible Z-Wave JS UI release as a persistent service.
- [ ] Bind the controller using its stable physical-port path rather than `/dev/ttyACM0`.
- [ ] Restrict the Z-Wave JS WebSocket and management UI to the trusted LAN; do not expose either publicly.
- [ ] Generate unique S0/S2 security keys where supported and store them outside public configuration.
- [ ] Preserve the controller NVM and security keys using the established private backup mechanism.
- [ ] Add the remote Z-Wave JS server to Home Assistant through the official Z-Wave integration.
- [ ] Verify reconnect behavior after restarting Z-Wave JS, restarting Home Assistant, and rebooting the Pi.
- [ ] Test inclusion, exclusion, state updates, and one safe command with a non-critical Z-Wave device.
- [ ] Record the controller and resulting Z-Wave network in the private infrastructure inventory.
- [ ] Add only useful Z-Wave health/status presentation to the existing infrastructure dashboard; avoid a parallel control dashboard.

## Acceptance criteria

Home Assistant controls the test device locally through the remote Z-Wave JS server, the controller survives all three restart scenarios without changing device paths, security material is not present in the public repository, and NUT continues operating normally on the same Pi.

Start by completing prerequisite issue #1936, then verify the Aeotec controller identity, firmware, and stable /dev/serial/by-path device path. Deploy the ARMv7-compatible Z-Wave JS UI service and connect it to Home Assistant through the official Z-Wave integration. Done means the test device works through all three restart scenarios, security material stays private, and NUT continues operating normally.

Written by the indexing model from the issue text.