Wire ADS-B end to end: secondary-sdr container running dump1090

node-26#9. New secondary-sdr-container claims the node's SECOND physical
SDR (RTL-SDR index 1 — op25 always claims index 0; no serial-based binding
yet, same gap op25 itself has). Its control API (start/stop/status/data,
mirroring op25_controller.py) launches dump1090 in adsb mode and exposes
the decoded aircraft.json snapshot; AIS mode 400s until it's wired next.

edge-node: on_config_push starts/stops it when secondary_sdr_mode changes,
lifespan resumes it after a restart if already configured, and a new
telemetry_uplink_loop polls its /secondary/data every 10s and POSTs
non-empty snapshots to C2's new /telemetry/adsb (same bearer-key pattern
call_recorder.py already uses for audio upload).

UNVERIFIED: this container has not been built or run against real hardware
in this session (sandboxed authoring machine, no docker) — dump1090's
--write-json field names are believed correct from its docs but not
confirmed against a real capture. Build + hardware smoke test before this
reaches a real node.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

secondary-sdr-container/app/config.py

@@ -0,0 +1,20 @@
+from pydantic_settings import BaseSettings
+
+
+class Settings(BaseSettings):
+    # Same rationale as op25-container's OP25_DEBUG_EXPOSE: both containers
+    # share the host network namespace (network_mode: host), so edge-node
+    # reaches this control API over localhost regardless of this flag. False
+    # (default) binds 127.0.0.1; true exposes unauthenticated start/stop to
+    # the node's LAN and should only ever be set for local development.
+    secondary_sdr_debug_expose: bool = False
+
+    class Config:
+        env_file = ".env"
+
+
+settings = Settings()
+
+
+def bind_host() -> str:
+    return "0.0.0.0" if settings.secondary_sdr_debug_expose else "127.0.0.1"