V2 two-unit cutover

Chose a separate V2 candidate unit with isolated config, database, port, credential, and build artifact over replacing production in place because the legacy service must remain immediately recoverable. Verify the candidate on loopback, then cut over explicitly; enable V2 only after health, UI, plugin activation, and real smoke checks pass. Rollback starts legacy first and never rewrites or deletes either database.