These tunnel gateways had no iperf3 server / VPN-status feed on the remote
peer (rpi), so route-health judged them by iperf3 -> success=0 -> permanently
'down', masking real tunnel outages (a 7-day SA-down went unnoticed).

Add is_pingonly_gw() (ikev2.fr, ikev2.gr) and judge them by ping loss alone
(loss>=50 or no data = dead). Suppress the iperf/vpn marks in group display
and health.json output for ping-only gateways so a healthy gw no longer shows
'iperf=FAIL'.
Co-Authored-By: Claude <noreply@anthropic.com>