feat(monitors): unify ping/dns/http into one Monitor entity + custom targets

Collapse the three former check types into a single core `Monitor` entity
with one management surface (/monitors), one result table (monitor_results),
and a single scheduled task. Every type can now watch a free-standing custom
destination (optional host_id) — not just a registered Host.

- models: Monitor + MonitorResult replace PingResult/DnsResult; Host loses its
  ping/dns facet columns (now Monitor rows linked by host_id).
- checks: monitors/{ping,dns,http}.py pure probes + runner.run_monitor
  dispatcher; one monitor_check scheduler with a per-monitor due-filter.
- status: single monitor_status_source replaces the three sources.
- UI: /monitors blueprint (type-aware add/edit/list/widget); host hub shows a
  host's linked monitors + "add monitor for this host"; nav + widget registry
  + alert metric catalog rewired. http plugin folded into core and removed.
- migration 0022 merges the http branch, data-migrates host facets +
  http_monitors + all three result histories, drops the old tables/columns.

Resolves the per-host ping/dns auto-attach issue (#275): monitors are now
explicit, never auto-added to every host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Jg27rgypiW2efULXJDtMC

steward/templates/alerts/rules_form.html

@@ -97,10 +97,12 @@
         </summary>
         <div style="margin-top:0.75rem;display:grid;gap:0.5rem;">
           {% set descs = {
-            "ping":    [("up", "1.0 = reachable, 0.0 = unreachable"),
-                        ("response_time_ms", "round-trip latency in milliseconds")],
-            "dns":     [("resolved", "1.0 = resolved, 0.0 = failed"),
-                        ("ip_changed", "1.0 when resolved IP differs from expected")],
+            "icmp":    [("is_up", "1.0 = reachable, 0.0 = unreachable"),
+                        ("response_ms", "round-trip latency in milliseconds")],
+            "tcp":     [("is_up", "1.0 = port open, 0.0 = unreachable"),
+                        ("response_ms", "TCP connect time in milliseconds")],
+            "dns":     [("is_up", "1.0 = resolved (and matches expected IP), 0.0 = failed"),
+                        ("response_ms", "resolution time in milliseconds")],
             "traefik": [("request_rate", "requests/sec for this router"),
                         ("error_rate", "fraction of 5xx responses (0–1)"),
                         ("latency_p50_ms", "median response time ms"),