feat(mcp): docker and host-agent tools; TLS and crash-loop cutoffs in Settings

MCP-5 of milestone 461 "MCP server: Steward as an LLM-inspectable,
LLM-operable hub". Contributed through each plugin's register_mcp_tools
hook, so they exist only while the plugin is enabled.

docker (viewer, read-only):
- list_containers: filter by host, status, compose project, or problem
  (restarting, crash_looping, unhealthy, oom_killed, exited_nonzero);
  problems sort first and each row names what is wrong.
- get_container: state, CPU/memory history across the raw/hourly seam,
  lifecycle events. A unique part of a swarm task name is enough.
- list_swarm_services: replicas per node (agent-less placements as ghosts)
  and the swarm's nodes.
- search_container_logs: text (% and _ literal), stream, range, context
  lines, paging by a full-precision `before` cursor; over-long lines keep
  both ends and say how much of the middle was cut.
- get_docker_disk_usage: bytes per host, reclaimable first.
- mcp_overview: failing containers and under-replicated swarm services
  join get_overview.

host_agent: list_agents (reporting / stale / pending, version, OS), and an
overview finding for agents registered over 30 minutes ago that never
checked in.

Settings > Thresholds gains the TLS-expiry warn/crit days (were 14/3 in
code) and the crash-loop deaths-per-hour count (3), which get_overview
and the docker tools now read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/mcp/test_tools.py

@@ -134,6 +134,10 @@ def test_monitor_findings():
     assert down["since"] == "2026-10-06T10:00:00Z"
     assert down["next"] == 'get_monitor(monitor="a")'
     assert (out["mon-b"]["severity"], out["mon-c"]["severity"]) == ("critical", "warning")
+    # The TLS window comes from Settings → Thresholds.
+    narrow = {f["subject"] for f in overview.monitor_findings(
+        mons, states, {}, NOW, {"warn": 5, "crit": 1})}
+    assert narrow == {"mon-a", "mon-b"}
 
 
 def test_alert_findings_severity_by_state():