feat(plugins): Traefik problems first, UniFi/SNMP/fleet on shared shapes, audit names its entities, templates on tokens (#5126)

Traefik: routers are graded from their latest scrape (router_state: crit on
any real 5xx share, warn on p95 past the latency critical cutoff or a high
4xx share). Failing and slow routers lead as cards that say why; healthy
ones fold into one table that stays open or shut across polls. Proxy
counts are stat tiles; certificates are graded by Settings -> Thresholds
(tls_days).

UniFi: WAN health is a stat strip (latency graded by the thresholds),
devices carry status dots, event categories and firewall actions are
badges, the alarm count reuses .count-badge (renamed from .nav-count).
SNMP: each device wears a status badge and its readings are stat tiles.

Agent fleet: the table comes first, with a Status column (Reporting /
Silent / Never reported, by the host page's stale_after_seconds), silent
agents first, hosts linked, last seen as |ago.

Audit: entries name their entity (one query per type, steward/audit/
service.py) and link it; something deleted since keeps the name its entry
recorded and says "(deleted)".

Tokens: charts read colours through chart-colors.js (stewardColor resolves
a token to the rgb the browser computed; Chart.js defaults take the page's
text and border colours), so host, history, Traefik and SNMP charts drop
their hex. Template hex colours reach 0 (HEX_CEILING = 0), the last rgba
pills go, and heavy weights (600/700/bold, 60 of them) become 500, the
house pair being 400/500; a guard keeps templates there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/traefik/routes.py

@@ -9,6 +9,7 @@ import json
 from steward.auth.middleware import require_role
 from steward.models.users import UserRole
 from steward.core.time_range import parse_range, DEFAULT_RANGE, bucket_seconds, subsample
+from steward.core.formatting import status_class
 from .models import TraefikAccessSummary, TraefikCert, TraefikGlobalStat, TraefikMetric
 
 traefik_bp = Blueprint("traefik", __name__, template_folder="templates")
@@ -36,6 +37,36 @@ def _sparkline(values: list[float], width: int = 80, height: int = 20) -> str:
     )
 
 
+# A router serving any real share of 5xx is failing; a 4xx share above this
+# is worth a look (clients hitting missing routes, auth failures).
+ERROR_5XX_PCT = 0.1
+ERROR_4XX_PCT = 1.0
+_GRADE_ORDER = {"crit": 0, "warn": 1, "ok": 2}
+
+
+def router_state(latest, thresholds: dict) -> tuple[str, str | None]:
+    """(grade, why) for a router's latest scrape: crit while it serves 5xx,
+    warn on a p95 past the latency critical cutoff (Settings → Thresholds)
+    or a high 4xx share, otherwise ok with nothing to say."""
+    if (latest.error_rate_5xx_pct or 0) > ERROR_5XX_PCT:
+        return "crit", f"{latest.error_rate_5xx_pct:.1f}% of responses are 5xx"
+    p95 = latest.latency_p95_ms
+    if p95 is not None and status_class(p95, "latency", thresholds) == "crit":
+        return "warn", f"p95 latency is {p95:.0f} ms"
+    if (latest.error_rate_4xx_pct or 0) > ERROR_4XX_PCT:
+        return "warn", f"{latest.error_rate_4xx_pct:.1f}% of responses are 4xx"
+    return "ok", None
+
+
+def split_routers(routers: list[dict]) -> tuple[list[dict], list[dict]]:
+    """(problems, healthy): failing routers before slow or noisy ones, each
+    group by name; healthy routers by name."""
+    problems = sorted((r for r in routers if r["state"] != "ok"),
+                      key=lambda r: (_GRADE_ORDER[r["state"]], r["name"].lower()))
+    healthy = sorted((r for r in routers if r["state"] == "ok"), key=lambda r: r["name"].lower())
+    return problems, healthy
+
+
 @traefik_bp.get("/")
 @require_role(UserRole.viewer)
 async def index():
@@ -59,6 +90,7 @@ async def rows():
     """HTMX fragment: service cards with sparklines scoped to selected time range."""
     since, range_key = parse_range(request.args.get("range"))
     now = datetime.now(timezone.utc)
+    thresholds = current_app.config.get("THRESHOLDS", {})
 
     async with current_app.db_sessionmaker() as db:
         # All known routers
@@ -103,9 +135,12 @@ async def rows():
             if not latest:
                 continue
 
+            state, why = router_state(latest, thresholds)
             router_data.append({
                 "name": router,
                 "latest": latest,
+                "state": state,
+                "why": why,
                 "sparkline_req": _sparkline([r.request_rate for r in history]),
                 "sparkline_p95": _sparkline([r.latency_p95_ms for r in history]),
                 "sparkline_5xx": _sparkline([r.error_rate_5xx_pct for r in history]),
@@ -136,9 +171,13 @@ async def rows():
             "days_remaining": days,
         })
 
+    problems, healthy = split_routers(router_data)
     return await render_template(
         "traefik/rows.html",
-        router_data=router_data,
+        problems=problems,
+        healthy=healthy,
+        error_4xx=ERROR_4XX_PCT,
+        error_5xx=ERROR_5XX_PCT,
         global_stat=global_stat,
         certs=certs,
         range_key=range_key,