feat(mcp): diagnostic tools — overview, hosts, monitors, alerts, metrics, audit

MCP-4 of milestone 461 "MCP server: Steward as an LLM-inspectable,
LLM-operable hub". Twelve read-only viewer tools:

- get_overview: what is wrong now, ranked critical-then-oldest. Failing
  monitors with their error and when the run of failures began, firing,
  pending and still-breaching acknowledged alerts, TLS certificates expiring
  within 14 days, agents that stopped reporting, hosts over the configured
  CPU/memory/disk thresholds (Settings > Thresholds), failed Ansible runs in
  the last 24h, and findings from enabled plugins through a new optional
  `mcp_overview(db)` plugin hook. Each finding names the call that shows
  its evidence.
- list_hosts, get_host, get_host_metrics
- list_monitors, get_monitor (HTTP header values and URL passwords are
  redacted)
- list_alerts, get_alert_history, list_alert_rules, list_maintenance_windows
- query_metrics: the whole metric store, narrowed one argument at a time
  (sources > resources > latest values > a series summary)
- list_audit_events

Shared shaping in steward/mcp/tools/_shape.py: UTC ISO times with age_s,
bounded lists that say when and how they were cut, series as
min/avg/max/p95/last plus a ≤60-point series, lookup by id or
case-insensitive name with a did-you-mean, and a range argument that
refuses an unknown key instead of reading it as 24h.

New core reads in steward/core/metric_series.py (sources and resources
via loose index scans, latest values via DISTINCT ON, series across the
raw/hourly-rollup seam). monitors/service.py gains monitor_states,
down_since and recent_failures; agent_overview_by_host now carries the
fullest disk and the last sample time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/server.py

@@ -77,6 +77,8 @@ class StewardMCPServer(MCPServer):
         self._steward_app = app
         self.tool_roles: dict[str, UserRole] = {}
         self.tool_plugins: dict[str, str] = {}
+        # plugin name -> its `mcp_overview(db)`: findings it adds to get_overview.
+        self.overview_sources: dict[str, object] = {}
 
     # ── registration ─────────────────────────────────────────────────────────
     def register_tool(self, fn, *, role: UserRole, read_only: bool, plugin: str | None = None) -> None:
@@ -100,13 +102,18 @@ class StewardMCPServer(MCPServer):
             self.tool_plugins[name] = plugin
 
     def register_plugin(self, name: str, module) -> None:
-        """Add a plugin's tools via its optional `register_mcp_tools(register)`.
+        """Add a plugin's tools via its optional `register_mcp_tools(register)`,
+        and its optional `mcp_overview(db)` as a get_overview findings source.
 
         Idempotent per plugin (hot-reload drops its previous tools first) and
         tolerant: a raising hook is logged and leaves the plugin with no tools,
         never a broken server.
         """
         self._drop_plugin_tools(name)
+        self.overview_sources.pop(name, None)
+        overview = getattr(module, "mcp_overview", None)
+        if callable(overview):
+            self.overview_sources[name] = overview
         hook = getattr(module, "register_mcp_tools", None)
         if hook is None:
             return
@@ -124,7 +131,7 @@ class StewardMCPServer(MCPServer):
             self.tool_plugins.pop(tool_name, None)
 
     # ── gating ───────────────────────────────────────────────────────────────
-    def _plugin_enabled(self, plugin: str) -> bool:
+    def plugin_enabled(self, plugin: str) -> bool:
         cfg = (self._steward_app.config.get("PLUGINS") or {}).get(plugin)
         return isinstance(cfg, dict) and bool(cfg.get("enabled"))
 
@@ -134,7 +141,7 @@ class StewardMCPServer(MCPServer):
         if required is None:
             return f"There is no Steward tool named {name!r}."
         plugin = self.tool_plugins.get(name)
-        if plugin and not self._plugin_enabled(plugin):
+        if plugin and not self.plugin_enabled(plugin):
             return (f"{name} belongs to the {plugin} plugin, which is disabled in this "
                     "Steward. An admin can enable it under Settings → Plugins.")
         if caller is None: