chore: mask stale autobot-vnc service on node .25

[mrveiss]

Problem

Node .25 (browser-automation) has a stale autobot-vnc systemd unit in failed state. When .25 operates in headless mode, autobot-vnc (tightvncserver) cannot start, leaving it permanently failed.

This caused false code_current_service_failed reports (fixed in #1709 by checking only monitored services). However, the stale unit still pollutes systemctl list-units --all output.

What's Needed

Server-side cleanup on .25:

sudo systemctl stop autobot-vnc 2>/dev/null
sudo systemctl disable autobot-vnc 2>/dev/null
sudo systemctl mask autobot-vnc

Or remove the unit file entirely if VNC mode is not planned for .25.

Discovered During

Investigating #1709 (node .25 false code_current_service_failed)

Impact

Low — cosmetic after #1709 fix, but clutters systemd unit listing.

[mrveiss]

Completed

Masked all 3 VNC services on .25 (browser-automation node):

Service	Action	Reason
autobot-vnc	stopped + masked	Stale — Playwright runs headless
browser-vnc	stopped + masked	Ghost service (MainPID=0), no-auth security risk
browser-vnc-websockify	stopped + masked	Depends on browser-vnc

Verification:

• Ports 5901 and 6080 freed
• autobot-playwright (headless, port 3000) unaffected and running
• browser-playwright (headed mode) remains disabled on disk — can be unmasked if needed
• ~230MB memory recovered

Unit files removed, symlinked to /dev/null. To re-enable headed VNC mode later: sudo systemctl unmask <service> and recreate unit files from Ansible templates.