Add opt-in isolated VPN database services

[makeitfutureDev]

Adds an opt-in operator CLI for a dedicated rootless OpenVPN service and an unprivileged MySQL verification container. Channels can reach a configured private database without granting VPN privileges or a container-engine socket to ordinary agent containers. Profiles are regenerated from an allowlist; a firewall restricts tunnel traffic to one database address/port and blocks fallback outside the tunnel.

Desired configuration and secret references use channel metadata. Protected profile revisions and a standalone helper support existing stable installations without upgrading their checkout. A user-systemd supervisor manages the pair with kernel locking, ownership checks and safe credential rotation. Verification executes only SELECT 1 and SHOW DATABASES.

Validation:

• 67 Node regressions passed, including existing container lifecycle and channel-secret tests.
• Eight Python checks passed.
• Real rootless TUN/firewall/extractor-isolation and tunnel-loss acceptance passed; disposable fixtures cleaned up.
• Supplied profile validation, private-file permissions and missing-secret fail-closed admission passed.
• Generated systemd unit validates; static checks, secret scan and DCO passed.

Remaining acceptance gates: provider VPN/MySQL login, credential rotation and restart/boot recovery with real credentials; private QA registry updates. The operator bundle is prepared and the service remains stopped pending credentials. No stable-branch promotion is proposed.