feat(host_agent): how far each host's clock is from Steward's (milestone 490)

- Agent 1.12.0 stamps each post with sent_at; ingest compares it with the
  moment the post arrived: clock_offset_s / clock_checked_at on the
  registration (host_agent_003), and a clock_off_secs metric (either way)
  that alert rules can watch. Replaces the old skew log, which measured the
  newest sample and was off by up to an interval.
- Settings -> Thresholds: Clock drift, 30 s warn / 5 min critical.
- Host page: 'clock 0.3s ahead' in the vitals line, toned past the warning.
- Hosts list: names hosts whose clock is off; when every reporting host is
  off by about the same amount, says Steward's own clock is the likely one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/migrations/versions/host_agent_003_clock_offset.py

@@ -0,0 +1,24 @@
+# plugins/host_agent/migrations/versions/host_agent_003_clock_offset.py
+"""host_agent: how far each host's clock is from Steward's (milestone 490)
+
+Revision ID: host_agent_003_clock_offset
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "host_agent_003_clock_offset"
+down_revision: Union[str, None] = "host_agent_002_host_ip"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("host_agent_registrations", sa.Column("clock_offset_s", sa.Float(), nullable=True))
+    op.add_column("host_agent_registrations",
+                  sa.Column("clock_checked_at", sa.DateTime(timezone=True), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("host_agent_registrations", "clock_checked_at")
+    op.drop_column("host_agent_registrations", "clock_offset_s")