feat(hosts): Phase 1 — host detail hub page (unify host IA)

Make Hosts the front-and-center hub. A host now has a real detail page at
/hosts/<id> that pulls its facets into one view, instead of management being
scattered across a nav-less Host-Agents area and the edit form.

- hosts: new GET /hosts/<id> detail route + hosts/detail.html. Shows the
  monitors summary (ping/DNS status + latency + uptime 24h/7d/30d), an Ansible
  section (linked target, link/create, run-playbook), and an embedded Agent
  panel. Hosts list name links here; ansible-link redirects here.
- host_agent: GET /plugins/host_agent/panel/<host_id> — a self-contained HTMX
  fragment embedded into the core hub across the plugin boundary (core never
  imports plugin models). Shows live agent metrics + Update/Rotate/Remove when
  installed, or the provisioning path when not: inline "generate managed key"
  warning, a prompt to link an Ansible target first, then Provision (bootstrap
  password) / Install (managed key) tied to the host's target scope.

Part of milestone 70 (Hosts hub). Phase 2+ will enrich the list, redirect the
old fleet/settings pages, and re-taxonomize plugins into capabilities vs
integrations.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/host_agent/routes.py

@@ -532,6 +532,43 @@ def _new_token_pair() -> tuple[str, str]:
     return raw, _hash_token(raw)
 
 
+@host_agent_bp.get("/panel/<host_id>")
+@require_role(UserRole.viewer)
+async def host_panel(host_id: str):
+    """Per-host agent panel embedded into the core Hosts hub via HTMX.
+
+    Shows live agent metrics if the host reports, otherwise the provisioning
+    actions — tied to the host's linked Ansible target (the SSH connection).
+    Self-contained fragment (no base.html) so it can be hx-swapped in.
+    """
+    from steward.core.capabilities import has_capability
+    from steward.models.ansible_inventory import AnsibleTarget
+
+    async with current_app.db_sessionmaker() as db:
+        host = (await db.execute(
+            select(Host).where(Host.id == host_id))).scalar_one_or_none()
+        if host is None:
+            return "", 404
+        reg = (await db.execute(select(HostAgentRegistration).where(
+            HostAgentRegistration.host_id == host_id))).scalar_one_or_none()
+        latest = await _latest_metrics_for_host(db, host.name) if reg else {}
+        target = (await db.execute(select(AnsibleTarget).where(
+            AnsibleTarget.host_id == host_id))).scalar_one_or_none()
+
+    hostlvl = latest.get(host.name, {})
+    ls = reg.last_seen_at if reg else None
+    stale = bool(reg) and (
+        ls is None or (datetime.now(timezone.utc) - ls).total_seconds() > _stale_after_seconds())
+
+    ansible_cfg = current_app.config.get("ANSIBLE", {})
+    return await render_template(
+        "panel.html",
+        host=host, reg=reg, hostlvl=hostlvl, stale=stale, target=target,
+        ansible_available=has_capability("ansible.run_playbook"),
+        managed_key_set=bool((ansible_cfg.get("ssh_public_key") or "").strip()),
+    )
+
+
 @host_agent_bp.get("/settings/")
 @require_role(UserRole.admin)
 async def settings_list():