Move kpi-web off whey to venus + audit whey for other host-role violations

Elazar 2026-08-23, direct: whey is backup-to-SSD only, per his standing month-long directive and the existing 2026-08-10 host-role split already in nw-whey-cc's CLAUDE.md (whey = SSH relay + occasional static HTML, NOT coding/monitoring/hosting, no infra, no tunnels). kpi-web (/opt/kpi-web/server.mjs, listen 127.0.0.1:9876+tailnet, maintainer-agents row: nw-venus-cc primary/bin-venus-cc backup) is a live violation — it is a Node service hosting a dashboard, deployed 2026-06-11, and should never have landed on whey under that split. TWO PARTS: 1. MOVE kpi-web venus-side. Re-deploy the service on venus (where it already reads FROM via telemetry_ro over the network — moving it colocates reader+DB), repoint any DNS/tailnet access, decommission the whey instance. nw-venus-cc's lane (existing maintainer seat). 2. AUDIT WHEY for everything else still running there that shouldn't be, per the same standing rule. nw-whey-cc/bin-whey-cc to enumerate: systemd units, cron, any listening ports, any /opt services — classify each as connectivity-only (keep) vs infra/hosting/monitoring (flag for move-or-kill). Coordinate via aro:nw. Open ONEDB-6 (Elazar's exposure decision, since 2026-06-06) may be superseded by this — the move makes the tailnet-exposure question moot if kpi-web no longer lives on the tailnet-only host. Flag to whoever owns ONEDB-6 once move is scoped.