feat(settings): configurable monitoring thresholds

Move the hardcoded warn/crit cutoffs into Settings -> Thresholds (DB-backed,
live, no restart). New thresholds.* keys + to_thresholds_cfg() + a
threshold_style(value, kind) jinja global that reads them; latency reuses the
existing ping good/warn keys, uptime is direction-aware (floors).

Replace the _macros metric_style/uptime_style macros (now removed) with the
global across Hosts-Overview, host_agent fleet + panel, Uptime/SLA widget, and
the ping page uptime column — all now honor the configured cutoffs. Uptime keeps
its green 'good' look when not degraded.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/app.py

@@ -59,6 +59,7 @@ def create_app(
         from .core.settings import (
             load_settings_sync, to_smtp_cfg, to_webhook_cfg,
             to_ansible_cfg, to_plugins_cfg, to_oidc_cfg, to_ldap_cfg,
+            to_thresholds_cfg,
         )
         _settings = load_settings_sync(app.config["DATABASE_URL"])
         app.config.update(
@@ -71,8 +72,10 @@ def create_app(
             PLUGINS=to_plugins_cfg(_settings),
             OIDC=to_oidc_cfg(_settings),
             LDAP=to_ldap_cfg(_settings),
+            THRESHOLDS=to_thresholds_cfg(_settings),
         )
     else:
+        from .core.settings import to_thresholds_cfg
         app.config.update(
             SESSION_LIFETIME_HOURS=8,
             DATA_RETENTION_DAYS=90,
@@ -83,8 +86,17 @@ def create_app(
             PLUGINS={},
             OIDC={"enabled": False},
             LDAP={"enabled": False},
+            THRESHOLDS=to_thresholds_cfg({}),
         )
 
+    # `threshold_style(value, kind)` — degraded-value coloring for templates,
+    # reading the configurable cutoffs from app.config["THRESHOLDS"]. Available
+    # in every template (core + plugin) via the jinja global.
+    from .core.settings import threshold_style_for as _ts_for
+    app.jinja_env.globals["threshold_style"] = (
+        lambda value, kind: _ts_for(value, kind, app.config.get("THRESHOLDS", {}))
+    )
+
     # ── 5. Plugin migrations ───────────────────────────────────────────────────
     # Step 3 already applied all plugin migrations via discover_all_plugin_migration_dirs,
     # so this is a no-op on normal startup. We still run it with all discovered dirs so