feat(mcp): diagnostic tools — overview, hosts, monitors, alerts, metrics, audit

MCP-4 of milestone 461 "MCP server: Steward as an LLM-inspectable,
LLM-operable hub". Twelve read-only viewer tools:

- get_overview: what is wrong now, ranked critical-then-oldest. Failing
  monitors with their error and when the run of failures began, firing,
  pending and still-breaching acknowledged alerts, TLS certificates expiring
  within 14 days, agents that stopped reporting, hosts over the configured
  CPU/memory/disk thresholds (Settings > Thresholds), failed Ansible runs in
  the last 24h, and findings from enabled plugins through a new optional
  `mcp_overview(db)` plugin hook. Each finding names the call that shows
  its evidence.
- list_hosts, get_host, get_host_metrics
- list_monitors, get_monitor (HTTP header values and URL passwords are
  redacted)
- list_alerts, get_alert_history, list_alert_rules, list_maintenance_windows
- query_metrics: the whole metric store, narrowed one argument at a time
  (sources > resources > latest values > a series summary)
- list_audit_events

Shared shaping in steward/mcp/tools/_shape.py: UTC ISO times with age_s,
bounded lists that say when and how they were cut, series as
min/avg/max/p95/last plus a ≤60-point series, lookup by id or
case-insensitive name with a did-you-mean, and a range argument that
refuses an unknown key instead of reading it as 24h.

New core reads in steward/core/metric_series.py (sources and resources
via loose index scans, latest values via DISTINCT ON, series across the
raw/hourly-rollup seam). monitors/service.py gains monitor_states,
down_since and recent_failures; agent_overview_by_host now carries the
fullest disk and the last sample time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/hosts/service.py

@@ -13,6 +13,11 @@ from steward.core.status import _heartbeat_title, _last_n_results, _uptime_by_mo
 from steward.models.monitors import Monitor, MonitorResult
 
 
+# Host-level agent metrics read for the at-a-glance views (plus the root
+# mount's disk_used_pct, read from the "<host>:/" sub-resource).
+AGENT_GLANCE_METRICS = ("cpu_pct", "mem_used_pct", "disk_used_pct", "disk_used_pct_worst")
+
+
 def agent_stale_after_seconds(config) -> int:
     """The host_agent plugin's freshness window from app config (default 180s)."""
     return int(((config.get("PLUGINS") or {}).get("host_agent") or {})
@@ -161,7 +166,10 @@ async def agent_metrics_by_host(db, host_names: list[str]) -> dict[str, dict]:
 async def agent_overview_by_host(
     db, host_names: list[str], stale_after_seconds: int = 180,
 ) -> dict[str, dict]:
-    """Per-host agent glance (cpu/mem/root-disk + freshness) from PluginMetric.
+    """Per-host agent glance (cpu/mem/disk + freshness) from PluginMetric.
+
+    {host_name: {cpu_pct, mem_used_pct, disk_used_pct_worst, disk_root,
+                 last_at, fresh}} for each host with any agent samples.
 
     Core-safe (no host_agent import). Freshness compares the latest host-level
     sample against the host_agent plugin's stale window (stale_after_seconds;
@@ -181,7 +189,7 @@ async def agent_overview_by_host(
         .where(
             PluginMetric.source_module == "host_agent",
             PluginMetric.resource_name.in_(resources),
-            PluginMetric.metric_name.in_(("cpu_pct", "mem_used_pct", "disk_used_pct")),
+            PluginMetric.metric_name.in_(AGENT_GLANCE_METRICS),
         )
         .group_by(PluginMetric.resource_name, PluginMetric.metric_name)
     ).subquery()
@@ -204,6 +212,7 @@ async def agent_overview_by_host(
                 d["_ts"] = r.recorded_at
     for d in out.values():
         ts = d.pop("_ts", None)
+        d["last_at"] = ts
         d["fresh"] = bool(ts and (now - ts).total_seconds() <= stale_after)
     return out