Wire ADS-B end to end: secondary-sdr container running dump1090

node-26#9. New secondary-sdr-container claims the node's SECOND physical
SDR (RTL-SDR index 1 — op25 always claims index 0; no serial-based binding
yet, same gap op25 itself has). Its control API (start/stop/status/data,
mirroring op25_controller.py) launches dump1090 in adsb mode and exposes
the decoded aircraft.json snapshot; AIS mode 400s until it's wired next.

edge-node: on_config_push starts/stops it when secondary_sdr_mode changes,
lifespan resumes it after a restart if already configured, and a new
telemetry_uplink_loop polls its /secondary/data every 10s and POSTs
non-empty snapshots to C2's new /telemetry/adsb (same bearer-key pattern
call_recorder.py already uses for audio upload).

UNVERIFIED: this container has not been built or run against real hardware
in this session (sandboxed authoring machine, no docker) — dump1090's
--write-json field names are believed correct from its docs but not
confirmed against a real capture. Build + hardware smoke test before this
reaches a real node.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -111,6 +111,13 @@ OP25_TERMINAL_URL=http://localhost:8081
 # for local development off a real node; leave false everywhere else.
 OP25_DEBUG_EXPOSE=false
 
+# Secondary SDR container (node-26#9) — only matters if a second physical SDR
+# is present and secondary_sdr_mode is set to adsb|ais via the edge dashboard
+# or C2. Usually no need to change.
+SECONDARY_SDR_API_URL=http://localhost:8002
+# Same caveat as OP25_DEBUG_EXPOSE — debugging aid only, leave false.
+SECONDARY_SDR_DEBUG_EXPOSE=false
+
 # --- Local dashboard / API login ---------------------------------------------
 # Protects the node's local dashboard (port 80) and JSON API. The node is
 # reachable by anyone on whatever site's LAN it's deployed to, so this MUST be