feat(host_agent): a group's updates and reboots on a weekly cadence, one host at a time (#5768)

#5768 "A maintenance cadence: a group's updates and reboots, one host at a
time, on a schedule". A plan names an inventory group, a weekday and time
in a time zone, a window and a reboot policy (only when required by
default). At its slot a run takes the group's hosts in order and gives each
a #5767 maintenance job. The next host starts only when the last is back in
service: its agent is posting and, for a swarm node, the node is active and
every replicated service is at its replicas. A failure stops the run, and
no host is started once the window has passed. A host's latest failure
shows as host_agent/<host>/maintenance_failed, for an ordinary alert rule.
The page is Hosts → Maintenance.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/__init__.py

@@ -36,6 +36,12 @@ def setup(app: "Quart") -> None:
     prune_by_age(HostDowntime.started_at)
 
 
+def get_audit_entities() -> dict:
+    """Audit rows about a maintenance plan name it and link to the plans page."""
+    from .models import HostMaintenancePlan
+    return {"maintenance_plan": (HostMaintenancePlan, "/plugins/host_agent/maintenance")}
+
+
 def get_scheduled_tasks() -> list:
     from .scheduler import make_maintenance_task, make_task
     return [make_task(_app), make_maintenance_task(_app)]
@@ -70,12 +76,14 @@ def get_alert_metrics() -> dict[str, list[str]]:
     healthy agent sits in tens of MB and a few %. updates_pending and
     updates_security are what the package manager has waiting, and
     reboot_required is 1 when the host needs a reboot (agent ≥ 1.16.0):
-    "security updates waiting" is updates_security > 0."""
+    "security updates waiting" is updates_security > 0. maintenance_failed
+    comes from the scheduler (#5768): 1 when the host's latest maintenance job
+    failed or timed out, 0 once one succeeds: "maintenance failed" is > 0."""
     return {"host_agent": [
         "cpu_pct", "mem_used_pct", "mem_available_bytes", "swap_used_bytes",
         "disk_used_pct_worst", "disk_used_pct", "inodes_used_pct", "load_1m", "load_5m", "load_15m",
         "load_pct",
         "uptime_secs", "seconds_since_seen", "clock_off_secs", "mounts_stalled",
         "agent_rss_bytes", "agent_cpu_pct",
-        "updates_pending", "updates_security", "reboot_required",
+        "updates_pending", "updates_security", "reboot_required", "maintenance_failed",
     ]}