feat(docker): per-host collection via the host agent; drop central scrape

Docker collection moves off the central single-socket scrape onto the host
agent, giving Docker a real per-host dimension. The Steward host now reports
its own containers like any other host, and same-named containers on different
hosts no longer collide.

- agent: stdlib UDS Docker client (AF_UNIX HTTP/1.1, Connection: close,
  chunked-aware), collect_docker() ports the cpu%/mem math; sample["docker"]
  added best-effort (silent-skip on absent/unreadable socket). AGENT_VERSION
  1.2.0 → 1.3.0; optional docker_socket config key.
- ingest: host_agent ingest hands per-host container snapshots to the docker
  plugin via a new "docker.persist_host_samples" capability (no hard import,
  no-op when docker disabled), inside a SAVEPOINT so a docker failure never
  sinks the host metrics. Resource names are host-scoped ("<host>/<name>").
- schema: docker_containers re-keyed (host_id, name); docker_metrics gains
  host_id; docker_002 migration DROP+recreates (dev-only, rule 122).
- ui: Docker page + widgets grouped by host with host links; new per-host
  Docker panel embedded on the Hosts hub (gated on docker enabled via a new
  enabled_plugins template context). Replaces the SQLite-only strftime
  bucketing with DB-agnostic Python bucketing.
- provisioning: install/provision playbooks add steward-agent to the docker
  group (best-effort) so the agent can read the socket.
- removed central scrape: docker scheduler.py + scraper.py deleted; plugin.yaml
  socket_path/scrape_interval_seconds/include_stopped dropped (plugin 2.0.0).
- tests: agent docker collector units (math, chunked decode, silent-skip,
  sample shape, config) + integration (host-scoped schema + persistence).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Jg27rgypiW2efULXJDtMC

steward/ansible/bundled/host_agent/install.yml

@@ -29,6 +29,23 @@
         shell: /usr/sbin/nologin
         create_home: false
 
+    # Let the agent read the local Docker socket so it can report this host's
+    # containers (the per-host docker collection path). Best-effort: skipped on
+    # hosts without Docker. Restart picks up the new supplementary group.
+    - name: Detect docker group
+      ansible.builtin.command: getent group docker
+      register: _docker_grp
+      changed_when: false
+      failed_when: false
+
+    - name: Add steward-agent to the docker group
+      ansible.builtin.user:
+        name: steward-agent
+        groups: docker
+        append: true
+      when: _docker_grp.rc == 0
+      notify: restart steward-agent
+
     - name: Create agent directory
       ansible.builtin.file:
         path: /usr/local/lib/steward-agent

steward/ansible/bundled/host_agent/provision.yml

@@ -85,6 +85,23 @@
         shell: /usr/sbin/nologin
         create_home: false
 
+    # Let the agent read the local Docker socket so it can report this host's
+    # containers (the per-host docker collection path). Best-effort: skipped on
+    # hosts without Docker. Restart picks up the new supplementary group.
+    - name: Detect docker group
+      ansible.builtin.command: getent group docker
+      register: _docker_grp
+      changed_when: false
+      failed_when: false
+
+    - name: Add steward-agent to the docker group
+      ansible.builtin.user:
+        name: steward-agent
+        groups: docker
+        append: true
+      when: _docker_grp.rc == 0
+      notify: restart steward-agent
+
     - name: Create agent directory
       ansible.builtin.file:
         path: /usr/local/lib/steward-agent

steward/app.py

@@ -167,7 +167,17 @@ def create_app(
     @app.context_processor
     def _inject_plugin_failures():
         from .core.plugin_manager import get_plugin_failures
-        return {"plugin_failures": get_plugin_failures()}
+        # enabled_plugins lets templates gate cross-plugin embeds (e.g. the
+        # Hosts hub only fetches the docker fragment when docker is enabled),
+        # avoiding a 404 to a route whose blueprint isn't registered.
+        enabled_plugins = {
+            name for name, cfg in (app.config.get("PLUGINS") or {}).items()
+            if isinstance(cfg, dict) and cfg.get("enabled")
+        }
+        return {
+            "plugin_failures": get_plugin_failures(),
+            "enabled_plugins": enabled_plugins,
+        }
 
     # ── 11. Share-token middleware ─────────────────────────────────────────────
     @app.before_request

steward/templates/hosts/detail.html

@@ -122,6 +122,11 @@
   <div class="card"><span style="color:var(--text-muted);font-size:0.85rem;">Loading agent…</span></div>
 </div>
 
+{# ── Docker (docker plugin fragment; renders nothing if the host has none) ──── #}
+{% if "docker" in enabled_plugins %}
+<div hx-get="/plugins/docker/host/{{ host.id }}" hx-trigger="load" hx-swap="innerHTML"></div>
+{% endif %}
+
 {# ── Ansible ──────────────────────────────────────────────────────────────── #}
 <div class="card">
   <h3 class="section-title">Ansible</h3>