fix(console): disable the unauthenticated serial console by default

socketiod does not validate the console token, keeps a single global PTY
and broadcasts its output to every connected client, so anyone who can
reach port 6081 can read and write a serial console that someone opened.
It is also broken for legitimate users, since console/views.py now writes
signed tokens that socketiod cannot parse.

Until it is rewritten, turn the serial console off by default:

- Add SERIAL_CONSOLE_ENABLED = False to the settings template; installs
  whose settings.py lacks it are treated as disabled.
- The console view shows an error instead of the xterm page for pty
  consoles while the setting is off.
- socketiod refuses to start unless SERIAL_CONSOLE_ENABLED is True.
- Supervisor: autostart=false for socketiod; drop -d (debug) from the
  supervisor and systemd definitions; fix the systemd unit description;
  conf/systemd/install.sh no longer suggests enabling socketiod.
- README: stop opening port 6081 and document how to enable the serial
  console on a trusted network.

console/tests.py

@@ -121,6 +121,7 @@ class ConsoleViewsTestCase(TestCase):
         self.assertTemplateUsed(response, "console-vnc-lite.html")
         self.assertIn("SPICE", str(response.context["console_error"]))
 
+    @override_settings(SERIAL_CONSOLE_ENABLED=True)
     @patch("console.views.wvmInstance")
     def test_console_superuser_pty(self, mock_wvm):
         mock_conn = MagicMock()
@@ -134,6 +135,23 @@ class ConsoleViewsTestCase(TestCase):
         self.assertEqual(response.status_code, 200)
         self.assertTemplateUsed(response, "console-xterm.html")
 
+    @override_settings(SERIAL_CONSOLE_ENABLED=False)
+    @patch("console.views.wvmInstance")
+    def test_console_pty_refused_when_serial_console_disabled(self, mock_wvm):
+        # ROADMAP S-01: socketiod is unauthenticated, so the serial console is
+        # disabled unless an admin explicitly enables it.
+        mock_conn = MagicMock()
+        mock_conn.get_console_type.return_value = "pty"
+        mock_wvm.return_value = mock_conn
+
+        self.client.force_login(self.admin_user)
+        url = reverse("console") + f"?token={self.token}"
+        response = self.client.get(url)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertTemplateNotUsed(response, "console-xterm.html")
+        self.assertIn("Serial console is disabled", str(response.context["console_error"]))
+
     @patch("console.views.wvmInstance")
     def test_console_user_assigned_instance_access(self, mock_wvm):
         mock_conn = MagicMock()