refactor: move host, docker, alert and monitor queries into service modules

MCP-3 of milestone 461 "MCP server: Steward as an LLM-inspectable,
LLM-operable hub". The /mcp tools run outside Quart's request pipeline, so
the queries they share with the pages now live in plain functions that take
an open session:

- steward/hosts/service.py: uptime, status, monitors, agent metrics,
  agent overview (stale threshold passed in, not read from current_app),
  CPU sparks.
- plugins/docker/service.py: bucket, container_history, host_map,
  list_containers, container_events, query_logs.
- steward/alerts/service.py: active_alerts (also used by core/reports),
  list_rules, list_maintenance_windows.
- steward/monitors/service.py: monitor_rows (was routes._rows_data).

Routes are repointed and render the same data. One behavior fix rides
along: the container-log search now escapes % and _ so they match
literally instead of acting as LIKE wildcards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/docker/test_service.py

@@ -0,0 +1,18 @@
+"""Unit tests for the docker plugin's shared query helpers (no DB)."""
+from plugins.docker import service as svc
+
+
+def test_escape_like_makes_wildcards_literal():
+    # A log search for "100%" or "user_id" must match those characters, not
+    # treat them as LIKE wildcards.
+    assert svc.escape_like("100%") == "100\\%"
+    assert svc.escape_like("user_id") == "user\\_id"
+    assert svc.escape_like("C:\\temp") == "C:\\\\temp"
+    assert svc.escape_like("plain text") == "plain text"
+
+
+def test_bucket_keeps_short_series_and_averages_long_ones():
+    assert svc.bucket([1.0, 2.0, 3.0]) == [1.0, 2.0, 3.0]
+    out = svc.bucket([float(i) for i in range(400)], target=40)
+    assert len(out) == 40
+    assert out[0] == sum(range(10)) / 10