feat(hosts): Phase 1 — host detail hub page (unify host IA)

Make Hosts the front-and-center hub. A host now has a real detail page at
/hosts/<id> that pulls its facets into one view, instead of management being
scattered across a nav-less Host-Agents area and the edit form.

- hosts: new GET /hosts/<id> detail route + hosts/detail.html. Shows the
  monitors summary (ping/DNS status + latency + uptime 24h/7d/30d), an Ansible
  section (linked target, link/create, run-playbook), and an embedded Agent
  panel. Hosts list name links here; ansible-link redirects here.
- host_agent: GET /plugins/host_agent/panel/<host_id> — a self-contained HTMX
  fragment embedded into the core hub across the plugin boundary (core never
  imports plugin models). Shows live agent metrics + Update/Rotate/Remove when
  installed, or the provisioning path when not: inline "generate managed key"
  warning, a prompt to link an Ansible target first, then Provision (bootstrap
  password) / Install (managed key) tied to the host's target scope.

Part of milestone 70 (Hosts hub). Phase 2+ will enrich the list, redirect the
old fleet/settings pages, and re-taxonomize plugins into capabilities vs
integrations.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/hosts/routes.py

@@ -115,6 +115,40 @@ async def list_hosts():
     )
 
 
+@hosts_bp.get("/<host_id>")
+@require_role(UserRole.viewer)
+async def host_detail(host_id: str):
+    """The host hub: monitors + agent (embedded fragment) + Ansible, one view."""
+    from steward.models.ansible_inventory import AnsibleTarget
+    from sqlalchemy.orm import selectinload
+
+    async with current_app.db_sessionmaker() as db:
+        host = (await db.execute(
+            select(Host).where(Host.id == host_id))).scalar_one_or_none()
+        if host is None:
+            return "Not found", 404
+        ping = (await db.execute(
+            select(PingResult).where(PingResult.host_id == host_id)
+            .order_by(PingResult.probed_at.desc()).limit(1))).scalar_one_or_none()
+        dns = (await db.execute(
+            select(DnsResult).where(DnsResult.host_id == host_id)
+            .order_by(DnsResult.resolved_at.desc()).limit(1))).scalar_one_or_none()
+        uptime = (await _compute_uptime(db)).get(host_id)
+        linked_target = (await db.execute(
+            select(AnsibleTarget).where(AnsibleTarget.host_id == host_id)
+            .options(selectinload(AnsibleTarget.groups)))).scalar_one_or_none()
+        linkable_targets = (await db.execute(
+            select(AnsibleTarget).where(AnsibleTarget.host_id.is_(None))
+            .order_by(AnsibleTarget.name))).scalars().all()
+
+    return await render_template(
+        "hosts/detail.html",
+        host=host, ping=ping, dns=dns, uptime=uptime,
+        linked_target=linked_target, linkable_targets=linkable_targets,
+        ansible_sources=_ansible_source_names(),
+    )
+
+
 @hosts_bp.get("/new")
 @require_role(UserRole.operator)
 async def new_host():
@@ -250,7 +284,7 @@ async def ansible_link(host_id: str):
                     )
                     db.add(new_target)
 
-    return redirect(f"/hosts/{host_id}/edit")
+    return redirect(f"/hosts/{host_id}")
 
 
 @hosts_bp.post("/<host_id>/run-playbook")