feat(docker): Docker's own status reaches Steward — an empty answer clears a host, a lost one greys it, a demoted manager's swarm rows go (#5152)

The agent (1.9.0) said nothing when Docker could not be asked and nothing
when Docker had no containers, so Steward could tell neither apart from the
other, and kept a host's last containers on screen as running either way.

- Agent: collect_docker returns (status, detail, containers). "ok" sends
  docker: [] when there are none; "unavailable" (no socket, nothing
  listening) and "error" (permission, timeout, bad answer) say why.
  collect_swarm says whether /info answered, and a node that is not a
  manager sends swarm_manager: false. A failed /info says nothing.
- Ingest: an empty docker list is a snapshot; the newest sample's status
  goes to the Docker plugin with the rest.
- docker_host_status (docker_011): per host, status, detail, since and
  last report. A host that never had Docker gets no row.
- An "ok" empty snapshot reaps the host's containers; an error keeps them.
  swarm_manager: false drops the host's swarm services and nodes.
- Docker page: a "Docker not answering" card names each such host, why,
  and since when; its containers read as stale. Duplicate header comment
  in rows.html removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/routes.py

@@ -214,15 +214,24 @@ async def ingest():
             latest_swarm_ts: datetime | None = None
             latest_disk: dict | None = None
             latest_disk_ts: datetime | None = None
+            # Whether Docker answered, from the newest sample that says (agent ≥ 1.9.0).
+            docker_status: dict | None = None
             for sample in samples:
                 try:
                     recorded_at = _parse_ts(sample["ts"])
                 except (KeyError, ValueError):
                     continue
                 metric_rows.extend(_expand_sample_to_metrics(sample, host.name, recorded_at))
+                # An empty list is a real answer: Docker is up with no containers.
                 docker = sample.get("docker")
-                if isinstance(docker, list) and docker:
+                if isinstance(docker, list):
                     docker_snapshots.append((recorded_at, docker))
+                status = sample.get("docker_status")
+                if status in ("ok", "unavailable", "error") and (
+                        docker_status is None or recorded_at > docker_status["at"]):
+                    docker_status = {
+                        "status": status, "detail": sample.get("docker_detail"),
+                        "at": recorded_at, "swarm_manager": sample.get("swarm_manager")}
                 # Container logs are time-series (append every line, not newest-only);
                 # each record carries its own Docker ts, recorded_at is the fallback.
                 docker_logs = sample.get("docker_logs")
@@ -257,7 +266,7 @@ async def ingest():
             # (opportunistic synergy via the capability registry — no hard import,
             # no-op when docker is disabled). A failure here must never sink the
             # whole ingest, so the metrics above still land.
-            if (docker_snapshots or latest_swarm is not None
+            if (docker_snapshots or latest_swarm is not None or docker_status is not None
                     or latest_disk is not None or docker_log_batches):
                 from steward.core.capabilities import has_capability, invoke_capability
                 if has_capability("docker.persist_host_samples"):
@@ -268,7 +277,7 @@ async def ingest():
                             await invoke_capability(
                                 "docker.persist_host_samples", UserRole.admin,
                                 session, host, docker_snapshots, latest_swarm,
-                                latest_disk, docker_log_batches,
+                                latest_disk, docker_log_batches, docker_status,
                             )
                     except Exception:
                         current_app.logger.exception(