feat(host_agent): at-a-glance disk = root (/) not "worst"; metric tooltips

The "Disk (worst)" number was opaque at a glance. Show the root filesystem (/)
usage instead — what people actually care about — on the host panel and the
dashboard widget. "Worst" is kept only for the widget's health dot (so a full
/var or /data still warns) and on the full-metrics page (per-mount + worst
trend). Added hover tooltips defining CPU / Memory / Disk / Load.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/host_agent/routes.py

@@ -341,7 +341,10 @@ async def _fleet_rows(session) -> list[dict]:
     )).scalars().all()
 
     latest: dict[str, dict[str, float]] = {}
+    root_disk: dict[str, float] = {}  # host_name → root (/) disk %
     for row in latest_rows:
+        if row.resource_name.endswith(":/") and row.metric_name == "disk_used_pct":
+            root_disk[row.resource_name[:-2]] = row.value
         if ":" in row.resource_name:
             continue
         latest.setdefault(row.resource_name, {})[row.metric_name] = row.value
@@ -362,7 +365,8 @@ async def _fleet_rows(session) -> list[dict]:
             "stale": stale,
             "cpu_pct": m.get("cpu_pct"),
             "mem_used_pct": m.get("mem_used_pct"),
-            "disk_worst": m.get("disk_used_pct_worst"),
+            "disk_worst": m.get("disk_used_pct_worst"),  # health dot only
+            "disk_root": root_disk.get(host.name),       # displayed at-a-glance
             "load_1m": m.get("load_1m"),
             "temp_max": m.get("temp_c_max"),
             "net_rx_bps": m.get("net_rx_bps"),
@@ -547,6 +551,9 @@ async def host_panel(host_id: str):
             AnsibleTarget.host_id == host_id))).scalar_one_or_none()
 
     hostlvl = latest.get(host.name, {})
+    # At-a-glance disk = the root filesystem (what people actually care about),
+    # not the "worst" mount which is opaque. Worst stays on the full-metrics page.
+    disk_root = (latest.get(host.name + ":/", {}) or {}).get("disk_used_pct")
     ls = reg.last_seen_at if reg else None
     # "Deployed" is gated on the agent actually checking in (last_seen_at), NOT on
     # the registration row — that row is minted before the playbook runs, so a
@@ -557,7 +564,8 @@ async def host_panel(host_id: str):
     ansible_cfg = current_app.config.get("ANSIBLE", {})
     return await render_template(
         "panel.html",
-        host=host, reg=reg, hostlvl=hostlvl, reporting=reporting, stale=stale, target=target,
+        host=host, reg=reg, hostlvl=hostlvl, disk_root=disk_root,
+        reporting=reporting, stale=stale, target=target,
         ansible_available=has_capability("ansible.run_playbook"),
         managed_key_set=bool((ansible_cfg.get("ssh_public_key") or "").strip()),
     )