feat: best-effort mirror (dual-send) of heartbeats + events

Optional second destination so each heartbeat and event is posted to a
mirror server (the office NAS) alongside the primary — dual-write to
de-risk the migration. Default off (blank mirror URLs); existing installs
unchanged.

- event_forwarder: mirror_reachable() fast-fail probe + mirror_forward_pass()
  (reliable event mirror with its OWN state file, total exception isolation,
  never raises into the primary path).
- series3_watcher: MIRROR_API_URL/MIRROR_SFM_URL/MIRROR_SFM_STATE_FILE config;
  best-effort heartbeat mirror; isolated event-mirror pass after the primary.
- settings dialog + config-template: new 'Mirror' tab / keys.
- 8 new tests incl. the isolation invariant. 44 passing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

config-template.ini

@@ -72,3 +72,14 @@ SFM_STATE_FILE =
 # `--seed-state` workflow that skips the historical backfill entirely.
 SFM_MAX_FORWARDS_PER_PASS = 500
 
+# --- Mirror (dual-send) ---
+# Optional best-effort second destination: post each heartbeat and event
+# to a mirror server (e.g. the office NAS) IN ADDITION to the primary
+# above.  Default off (blank URLs).  The mirror can never delay or fail
+# the primary; the event mirror keeps its own state file so nothing is
+# lost while it's down.  See docs/mirror-dual-send-design.md.
+MIRROR_API_URL =                          ; base URL e.g. http://10.0.0.x:8001 (blank = off)
+MIRROR_SFM_URL =                          ; base URL e.g. http://10.0.0.x:8200 (blank = off)
+# Blank → defaults to <log dir>/sfm_forwarded_mirror.json
+MIRROR_SFM_STATE_FILE =
+