feat(docker): per-host collection via the host agent; drop central scrape

Docker collection moves off the central single-socket scrape onto the host
agent, giving Docker a real per-host dimension. The Steward host now reports
its own containers like any other host, and same-named containers on different
hosts no longer collide.

- agent: stdlib UDS Docker client (AF_UNIX HTTP/1.1, Connection: close,
  chunked-aware), collect_docker() ports the cpu%/mem math; sample["docker"]
  added best-effort (silent-skip on absent/unreadable socket). AGENT_VERSION
  1.2.0 → 1.3.0; optional docker_socket config key.
- ingest: host_agent ingest hands per-host container snapshots to the docker
  plugin via a new "docker.persist_host_samples" capability (no hard import,
  no-op when docker disabled), inside a SAVEPOINT so a docker failure never
  sinks the host metrics. Resource names are host-scoped ("<host>/<name>").
- schema: docker_containers re-keyed (host_id, name); docker_metrics gains
  host_id; docker_002 migration DROP+recreates (dev-only, rule 122).
- ui: Docker page + widgets grouped by host with host links; new per-host
  Docker panel embedded on the Hosts hub (gated on docker enabled via a new
  enabled_plugins template context). Replaces the SQLite-only strftime
  bucketing with DB-agnostic Python bucketing.
- provisioning: install/provision playbooks add steward-agent to the docker
  group (best-effort) so the agent can read the socket.
- removed central scrape: docker scheduler.py + scraper.py deleted; plugin.yaml
  socket_path/scrape_interval_seconds/include_stopped dropped (plugin 2.0.0).
- tests: agent docker collector units (math, chunked decode, silent-skip,
  sample shape, config) + integration (host-scoped schema + persistence).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Jg27rgypiW2efULXJDtMC

plugins/host_agent/routes.py

@@ -196,6 +196,7 @@ async def ingest():
 
         accepted = 0
         latest_ts: datetime | None = None
+        docker_snapshots: list[tuple[datetime, list]] = []
         for sample in samples:
             try:
                 recorded_at = _parse_ts(sample["ts"])
@@ -204,6 +205,9 @@ async def ingest():
             metrics = _expand_sample_to_metrics(sample, host.name, recorded_at)
             for m in metrics:
                 session.add(m)
+            docker = sample.get("docker")
+            if isinstance(docker, list) and docker:
+                docker_snapshots.append((recorded_at, docker))
             accepted += 1
             if latest_ts is None or recorded_at > latest_ts:
                 latest_ts = recorded_at
@@ -212,6 +216,26 @@ async def ingest():
             await session.rollback()
             return _error(400, "malformed_payload", "no valid samples")
 
+        # Hand host-scoped container data to the docker plugin if it's enabled
+        # (opportunistic synergy via the capability registry — no hard import,
+        # no-op when docker is disabled). A failure here must never sink the
+        # whole ingest, so the metrics above still land.
+        if docker_snapshots:
+            from steward.core.capabilities import has_capability, invoke_capability
+            if has_capability("docker.persist_host_samples"):
+                try:
+                    # SAVEPOINT so a docker-side failure rolls back only the
+                    # docker writes, leaving the host metrics intact to commit.
+                    async with session.begin_nested():
+                        await invoke_capability(
+                            "docker.persist_host_samples", UserRole.admin,
+                            session, host, docker_snapshots,
+                        )
+                except Exception:
+                    current_app.logger.exception(
+                        "host_agent ingest: docker persist failed for host=%s",
+                        host.name)
+
         md = payload.get("metadata") or {}
         changed = False
         if latest_ts and (reg.last_seen_at is None or latest_ts > reg.last_seen_at):