feat(mcp): docker and host-agent tools; TLS and crash-loop cutoffs in Settings

MCP-5 of milestone 461 "MCP server: Steward as an LLM-inspectable,
LLM-operable hub". Contributed through each plugin's register_mcp_tools
hook, so they exist only while the plugin is enabled.

docker (viewer, read-only):
- list_containers: filter by host, status, compose project, or problem
  (restarting, crash_looping, unhealthy, oom_killed, exited_nonzero);
  problems sort first and each row names what is wrong.
- get_container: state, CPU/memory history across the raw/hourly seam,
  lifecycle events. A unique part of a swarm task name is enough.
- list_swarm_services: replicas per node (agent-less placements as ghosts)
  and the swarm's nodes.
- search_container_logs: text (% and _ literal), stream, range, context
  lines, paging by a full-precision `before` cursor; over-long lines keep
  both ends and say how much of the middle was cut.
- get_docker_disk_usage: bytes per host, reclaimable first.
- mcp_overview: failing containers and under-replicated swarm services
  join get_overview.

host_agent: list_agents (reporting / stale / pending, version, OS), and an
overview finding for agents registered over 30 minutes ago that never
checked in.

Settings > Thresholds gains the TLS-expiry warn/crit days (were 14/3 in
code) and the crash-loop deaths-per-hour count (3), which get_overview
and the docker tools now read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/docker/test_mcp_tools.py

@@ -0,0 +1,80 @@
+"""The docker plugin's MCP tools: what counts as a problem, and how it is reported."""
+from datetime import datetime, timedelta, timezone
+from types import SimpleNamespace as NS
+from unittest.mock import MagicMock
+
+import plugins.docker as docker_plugin
+from plugins.docker import mcp_tools as t
+
+NOW = datetime(2026, 10, 6, 12, 0, tzinfo=timezone.utc)
+
+
+def _c(**kw):
+    base = dict(name="web", host_id="h1", image="nginx", status="running", health=None,
+                exit_code=None, oom_killed=False, restart_count=0, cpu_pct=1.0, mem_pct=2.0,
+                mem_usage_bytes=1, mem_limit_bytes=2, started_at=NOW - timedelta(hours=1),
+                compose_project=None, service_name=None, scraped_at=NOW - timedelta(seconds=30))
+    base.update(kw)
+    return NS(**base)
+
+
+def test_container_problems_most_severe_first():
+    assert t.container_problems(_c(), 0, False) == []
+    assert t.container_problems(_c(status="restarting"), 4, True) == ["restarting", "crash_looping"]
+    # The crash-loop count comes from Settings → Thresholds.
+    assert t.container_problems(_c(), 2, True) == []
+    assert t.container_problems(_c(), 2, True, crash_loop_deaths=2) == ["crash_looping"]
+    assert t.container_problems(_c(health="unhealthy", oom_killed=True), 0, False) == ["unhealthy", "oom_killed"]
+    # An unhealthy flag on a stopped container is stale; it isn't failing a healthcheck now.
+    assert t.container_problems(_c(status="exited", health="unhealthy", exit_code=0), 0, False) == []
+
+
+def test_exited_nonzero_needs_a_recent_death():
+    crashed = _c(status="exited", exit_code=137)
+    assert t.container_problems(crashed, 1, True) == ["exited_nonzero"]
+    # A container that died weeks ago and was left stopped is not news.
+    assert t.container_problems(crashed, 0, False) == []
+
+
+def test_cut_middle_keeps_both_ends_and_sizes_the_gap():
+    assert t.cut_middle("short") == "short"
+    line = "A" * 10 + "B" * 100 + "C" * 10
+    cut = t.cut_middle(line, limit=20)
+    assert cut.startswith("A" * 10) and cut.endswith("C" * 10)
+    assert "[… 100 characters omitted …]" in cut
+
+
+def test_container_row_uptime_only_while_running():
+    row = t.container_row(_c(), {"h1": "nas"}, [], NOW)
+    assert row["host_name"] == "nas" and row["uptime_s"] == 3600 and row["reported_age_s"] == 30
+    assert t.container_row(_c(status="exited"), {}, [], NOW)["uptime_s"] is None
+
+
+def test_container_findings_one_per_container_with_every_problem_named():
+    rows = [t.container_row(_c(name="db", status="restarting", exit_code=1), {"h1": "nas"},
+                            ["restarting", "crash_looping"], NOW),
+            t.container_row(_c(name="ok"), {}, [], NOW)]
+    (f,) = t.container_findings(rows)
+    assert f["severity"] == "critical" and f["kind"] == "container_restarting"
+    assert "is restarting and keeps dying" in f["summary"] and "on nas" in f["summary"]
+    assert "(exit 1)" in f["summary"]
+    assert f["next"] == 'get_container(container="db", host="h1")'
+
+
+def test_service_findings_by_state():
+    svcs = [{"name": "a", "state": "healthy", "running": 2, "desired": 2},
+            {"name": "b", "state": "degraded", "running": 1, "desired": 3},
+            {"name": "c", "state": "down", "running": 0, "desired": 1}]
+    got = {f["subject"]: f["severity"] for f in t.service_findings(svcs)}
+    assert got == {"b": "warning", "c": "critical"}
+
+
+def test_plugin_exposes_the_mcp_hooks():
+    reg = MagicMock()
+    docker_plugin.register_mcp_tools(reg)
+    names = {call.args[0].__name__ for call in reg.call_args_list}
+    assert names == {"list_containers", "get_container", "list_swarm_services",
+                     "search_container_logs", "get_docker_disk_usage"}
+    for call in reg.call_args_list:
+        assert call.kwargs["read_only"] is True
+    assert callable(docker_plugin.mcp_overview)

tests/plugins/host_agent/test_mcp_tools.py

@@ -0,0 +1,22 @@
+"""The host_agent plugin's MCP tools."""
+from datetime import datetime, timedelta, timezone
+from types import SimpleNamespace as NS
+from unittest.mock import MagicMock
+
+import plugins.host_agent as agent_plugin
+from plugins.host_agent.mcp_tools import agent_state
+
+NOW = datetime(2026, 10, 6, 12, 0, tzinfo=timezone.utc)
+
+
+def test_agent_state():
+    assert agent_state(NS(last_seen_at=None), NOW, 180) == "pending"
+    assert agent_state(NS(last_seen_at=NOW - timedelta(seconds=60)), NOW, 180) == "reporting"
+    assert agent_state(NS(last_seen_at=NOW - timedelta(minutes=10)), NOW, 180) == "stale"
+
+
+def test_plugin_exposes_the_mcp_hooks():
+    reg = MagicMock()
+    agent_plugin.register_mcp_tools(reg)
+    assert [c.args[0].__name__ for c in reg.call_args_list] == ["list_agents"]
+    assert callable(agent_plugin.mcp_overview)