refactor: move host, docker, alert and monitor queries into service modules

MCP-3 of milestone 461 "MCP server: Steward as an LLM-inspectable,
LLM-operable hub". The /mcp tools run outside Quart's request pipeline, so
the queries they share with the pages now live in plain functions that take
an open session:

- steward/hosts/service.py: uptime, status, monitors, agent metrics,
  agent overview (stale threshold passed in, not read from current_app),
  CPU sparks.
- plugins/docker/service.py: bucket, container_history, host_map,
  list_containers, container_events, query_logs.
- steward/alerts/service.py: active_alerts (also used by core/reports),
  list_rules, list_maintenance_windows.
- steward/monitors/service.py: monitor_rows (was routes._rows_data).

Routes are repointed and render the same data. One behavior fix rides
along: the container-log search now escapes % and _ so they match
literally instead of acting as LIKE wildcards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/docker/routes.py

@@ -13,11 +13,12 @@ from steward.auth.middleware import require_role
 from steward.models.users import UserRole
 from steward.models.hosts import Host
 from steward.core.time_range import parse_range, DEFAULT_RANGE
+from . import service as docker_svc
 from .dedup import dedup_by_container_id
 from .swarm_view import build_swarm_services
 from .models import (
-    DockerContainer, DockerDiskUsage, DockerEvent, DockerImage, DockerLog,
-    DockerMetric, DockerSwarmNode, DockerSwarmService,
+    DockerContainer, DockerDiskUsage, DockerEvent, DockerImage,
+    DockerSwarmNode, DockerSwarmService,
 )
 
 docker_bp = Blueprint("docker", __name__, template_folder="templates")
@@ -95,38 +96,6 @@ def _sparkline(values: list[float], width: int = 80, height: int = 20) -> str:
     )
 
 
-def _bucket(values: list[float], target: int = 40) -> list[float]:
-    """Bucket-average a series down to ~target points (DB-agnostic, in Python).
-
-    Replaces the old SQL strftime() bucketing, which was SQLite-only and broke
-    on Postgres. Agent cadence is dense, so a multi-hour window is hundreds of
-    rows — averaging into a readable point count keeps the sparkline's shape.
-    """
-    n = len(values)
-    if n <= target:
-        return values
-    size = (n + target - 1) // target
-    out: list[float] = []
-    for i in range(0, n, size):
-        chunk = values[i:i + size]
-        out.append(sum(chunk) / len(chunk))
-    return out
-
-
-async def _container_history(db, host_id: str, name: str, since) -> tuple[list, list]:
-    """Return (cpu_series, mem_series) sparkline-ready for one host's container."""
-    rows = (await db.execute(
-        select(DockerMetric.cpu_pct, DockerMetric.mem_pct)
-        .where(DockerMetric.host_id == host_id)
-        .where(DockerMetric.container_name == name)
-        .where(DockerMetric.scraped_at >= since)
-        .order_by(DockerMetric.scraped_at)
-    )).all()
-    cpu = _bucket([r.cpu_pct or 0.0 for r in rows])
-    mem = _bucket([r.mem_pct or 0.0 for r in rows])
-    return cpu, mem
-
-
 @docker_bp.get("/")
 @require_role(UserRole.viewer)
 async def index():
@@ -148,15 +117,6 @@ async def index():
     )
 
 
-async def _host_map(db, host_ids: set[str]) -> dict[str, Host]:
-    if not host_ids:
-        return {}
-    return {
-        h.id: h for h in (await db.execute(
-            select(Host).where(Host.id.in_(host_ids)))).scalars().all()
-    }
-
-
 @docker_bp.get("/rows")
 @require_role(UserRole.viewer)
 async def rows():
@@ -165,15 +125,10 @@ async def rows():
     since, range_key = parse_range(request.args.get("range"))
 
     async with current_app.db_sessionmaker() as db:
-        containers = list((await db.execute(
-            select(DockerContainer).order_by(
-                (DockerContainer.status == "running").desc(),
-                DockerContainer.name,
-            )
-        )).scalars())
+        containers = await docker_svc.list_containers(db)
         services = list((await db.execute(select(DockerSwarmService))).scalars())
         nodes = list((await db.execute(select(DockerSwarmNode))).scalars())
-        hosts = await _host_map(
+        hosts = await docker_svc.host_map(
             db,
             {c.host_id for c in containers}
             | {n.host_id for n in nodes} | {s.host_id for s in services},
@@ -198,7 +153,7 @@ async def rows():
                     "host_name": host.name if host else c.host_id,
                     "containers": [], "running": 0, "stopped": 0,
                 }
-            cpu_hist, mem_hist = await _container_history(db, c.host_id, c.name, since)
+            cpu_hist, mem_hist = await docker_svc.container_history(db, c.host_id, c.name, since)
             g["containers"].append({
                 "container": c,
                 "ports": json.loads(c.ports_json) if c.ports_json else [],
@@ -267,7 +222,7 @@ async def widget():
             select(func.count(func.distinct(DockerEvent.container_name)))
             .where(DockerEvent.event.in_(("die", "oom")), DockerEvent.at >= since_24h)
         )).scalar() or 0
-        hosts = await _host_map(
+        hosts = await docker_svc.host_map(
             db,
             {c.host_id for c in all_containers}
             | {n.host_id for n in nodes} | {s.host_id for s in services},
@@ -322,7 +277,7 @@ async def widget_resources():
             .where(DockerContainer.status == "running")
             .order_by(DockerContainer.cpu_pct.desc().nullslast())
         )).scalars()))[:limit]
-        hosts = await _host_map(db, {c.host_id for c in containers})
+        hosts = await docker_svc.host_map(db, {c.host_id for c in containers})
 
     rows_data = [
         {"c": c, "host_name": hosts[c.host_id].name if c.host_id in hosts else c.host_id}
@@ -345,14 +300,7 @@ async def host_panel(host_id: str):
     don't carry an empty card.
     """
     async with current_app.db_sessionmaker() as db:
-        containers = list((await db.execute(
-            select(DockerContainer)
-            .where(DockerContainer.host_id == host_id)
-            .order_by(
-                (DockerContainer.status == "running").desc(),
-                DockerContainer.name,
-            )
-        )).scalars())
+        containers = await docker_svc.list_containers(db, host_id)
 
     if not containers:
         return ""
@@ -382,15 +330,7 @@ async def container_detail(host_id: str, name: str):
     async with current_app.db_sessionmaker() as db:
         c = await db.get(DockerContainer, (host_id, name))
         host = await db.get(Host, host_id)
-        events = []
-        if c is not None:
-            events = list((await db.execute(
-                select(DockerEvent)
-                .where(DockerEvent.host_id == host_id)
-                .where(DockerEvent.container_name == name)
-                .order_by(DockerEvent.at.desc())
-                .limit(50)
-            )).scalars())
+        events = await docker_svc.container_events(db, host_id, name) if c is not None else []
 
     if c is None:
         return await render_template(
@@ -438,7 +378,7 @@ async def swarm():
             select(DockerSwarmNode).order_by(
                 DockerSwarmNode.role, DockerSwarmNode.hostname)
         )).scalars())
-        hosts = await _host_map(db, {s.host_id for s in services} | {n.host_id for n in nodes})
+        hosts = await docker_svc.host_map(db, {s.host_id for s in services} | {n.host_id for n in nodes})
 
     # ── Group reporting managers into swarms by shared node membership ──────────
     manager_ids = {s.host_id for s in services} | {n.host_id for n in nodes}
@@ -540,7 +480,7 @@ async def disk():
         stopped_by_host: dict[str, int] = {}
         for hid in stopped_rows:
             stopped_by_host[hid] = stopped_by_host.get(hid, 0) + 1
-        hosts = await _host_map(db, {s.host_id for s in summaries})
+        hosts = await docker_svc.host_map(db, {s.host_id for s in summaries})
         # Which hosts have a linked Ansible target — gates the prune buttons
         # (a target is required to route the playbook run to that host).
         host_ids = {s.host_id for s in summaries}
@@ -639,7 +579,7 @@ async def container_history(host_id: str, name: str):
     """HTMX fragment: CPU + memory sparklines for the selected time range."""
     since, range_key = parse_range(request.args.get("range"))
     async with current_app.db_sessionmaker() as db:
-        cpu_hist, mem_hist = await _container_history(db, host_id, name, since)
+        cpu_hist, mem_hist = await docker_svc.container_history(db, host_id, name, since)
     return await render_template(
         "docker/_container_history.html",
         sparkline_cpu=_sparkline(cpu_hist, width=320, height=48),
@@ -654,26 +594,6 @@ async def container_history(host_id: str, name: str):
 _LOG_TAIL_DEFAULT = 500
 
 
-async def _query_logs(db, host_id: str, name: str, stream: str, query: str,
-                      limit: int) -> list:
-    """The recent retained lines for one container, newest-first, optionally
-    filtered by stream and a case-insensitive substring.
-
-    Newest-first is deliberate: the viewer replaces the list on each poll, which
-    resets scroll to the top — so the latest lines stay visible without any
-    scroll handling, and older lines are a scroll away.
-    """
-    stmt = (select(DockerLog.ts, DockerLog.stream, DockerLog.line)
-            .where(DockerLog.host_id == host_id)
-            .where(DockerLog.container_name == name))
-    if stream in ("stdout", "stderr"):
-        stmt = stmt.where(DockerLog.stream == stream)
-    if query:
-        stmt = stmt.where(DockerLog.line.ilike(f"%{query}%"))
-    stmt = stmt.order_by(DockerLog.ts.desc(), DockerLog.id.desc()).limit(limit)
-    return (await db.execute(stmt)).all()
-
-
 @docker_bp.get("/container/<host_id>/<name>/logs")
 @require_role(UserRole.viewer)
 async def container_logs(host_id: str, name: str):
@@ -693,7 +613,7 @@ async def container_logs_lines(host_id: str, name: str):
     stream = request.args.get("stream", "all")
     query = (request.args.get("q") or "").strip()
     async with current_app.db_sessionmaker() as db:
-        rows = await _query_logs(db, host_id, name, stream, query, _LOG_TAIL_DEFAULT)
+        rows = await docker_svc.query_logs(db, host_id, name, stream, query, _LOG_TAIL_DEFAULT)
     return await render_template(
         "docker/_container_logs_lines.html",
         lines=[{"ts": r.ts, "stream": r.stream, "line": r.line} for r in rows],