feat(plugins): fold first-party plugins in-tree; bundled + external roots

First-party plugins (host_agent, http, snmp, traefik, unifi, docker) are now
tracked under plugins/ and baked into the image, so they version atomically
with core — ending the cross-repo import drift the roundtable->steward rename
exposed. History for these files is preserved in the archived Roundtable-plugins
repo.

Plugin discovery becomes multi-root: PLUGIN_DIR (single) -> PLUGIN_DIRS
(bundled first, then external) + PLUGIN_INSTALL_DIR. Bundled ships in the image;
third-party plugins still mount at runtime into the external root
(STEWARD_PLUGIN_DIR, default /data/plugins) and downloads/installs land there.
Bundled shadows external on a name collision.

- config.py: load_bootstrap returns plugin_dirs + plugin_install_dir
- app.py: iterate PLUGIN_DIRS at the migration + load sites
- migration_runner.py: discover_all_in() unions every plugin root
- plugin_manager.py: resolve_plugin_path() (pure, first-root-wins); load /
  install / hot-reload span all roots; installs target the external root
- settings/routes.py: _discover_plugins scans all roots, dedup bundled-first
- Dockerfile: COPY plugins/ ; docker-compose: drop host bind, document external
- tests/test_plugin_dirs.py: resolution, multi-root discovery, bootstrap split

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/host_agent/templates/install.sh.j2

@@ -0,0 +1,81 @@
+#!/bin/sh
+# Steward host agent installer
+# Generated for: {{ host_name }}  ({{ host_address }})
+# Steward URL: {{ url }}
+set -e
+
+STEWARD_URL="{{ url }}"
+AGENT_TOKEN="{{ token }}"
+AGENT_VERSION="{{ agent_version }}"
+
+AGENT_USER="steward-agent"
+AGENT_DIR="/usr/local/lib/steward-agent"
+CONF_FILE="/etc/steward-agent.conf"
+UNIT_FILE="/etc/systemd/system/steward-agent.service"
+
+# ── preflight ────────────────────────────────────────────────────────────────
+[ "$(id -u)" = "0" ] || { echo "must run as root (use sudo)"; exit 1; }
+command -v systemctl >/dev/null 2>&1 || { echo "systemd not found — unsupported init system"; exit 1; }
+command -v python3   >/dev/null 2>&1 || { echo "python3 not found — install python3 first"; exit 1; }
+
+# Handle --uninstall
+if [ "${1:-}" = "--uninstall" ]; then
+    systemctl disable --now steward-agent.service 2>/dev/null || true
+    rm -f "$UNIT_FILE" "$CONF_FILE"
+    rm -rf "$AGENT_DIR"
+    systemctl daemon-reload
+    # keep the system user — removing it risks orphaned files elsewhere
+    echo "uninstalled"
+    exit 0
+fi
+
+# ── create system user ───────────────────────────────────────────────────────
+if ! id "$AGENT_USER" >/dev/null 2>&1; then
+    useradd --system --no-create-home --shell /usr/sbin/nologin "$AGENT_USER"
+fi
+
+# ── drop the agent file ──────────────────────────────────────────────────────
+mkdir -p "$AGENT_DIR"
+curl -sSL "${STEWARD_URL}/plugins/host_agent/agent.py" -o "$AGENT_DIR/agent.py"
+chmod 0755 "$AGENT_DIR/agent.py"
+chown root:root "$AGENT_DIR/agent.py"
+
+# ── write config ─────────────────────────────────────────────────────────────
+cat > "$CONF_FILE" <<EOF
+url = $STEWARD_URL
+token = $AGENT_TOKEN
+interval_seconds = 30
+EOF
+chown "root:$AGENT_USER" "$CONF_FILE"
+chmod 0640 "$CONF_FILE"
+
+# ── write systemd unit ───────────────────────────────────────────────────────
+cat > "$UNIT_FILE" <<EOF
+[Unit]
+Description=Steward host agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=$AGENT_USER
+ExecStart=/usr/bin/python3 $AGENT_DIR/agent.py
+Restart=on-failure
+RestartSec=10
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadOnlyPaths=/proc /sys
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now steward-agent.service
+
+echo
+echo "Steward host agent $AGENT_VERSION installed and running."
+echo "Check status:  systemctl status steward-agent"
+echo "Logs:          journalctl -u steward-agent -f"

plugins/host_agent/templates/settings_list.html

@@ -0,0 +1,65 @@
+{% extends "base.html" %}
+{% block title %}Host Agent — Steward{% endblock %}
+{% block content %}
+<h1 class="page-title">Host Agent — Registered Hosts</h1>
+
+{% if new_token %}
+<div class="card" style="background:var(--accent-bg);">
+  <h3>New token — copy this install command now</h3>
+  <p style="font-size:0.82rem;color:var(--text-muted);">
+    This is the only time the raw token is shown. Rotate if you lose it.
+  </p>
+  <pre style="user-select:all;word-break:break-all;">curl -sSL '{{ install_url }}' | sudo sh</pre>
+</div>
+{% endif %}
+
+<div class="card">
+  <form method="post" action="/plugins/host_agent/settings/add-host"
+        style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
+    <div class="form-group" style="margin-bottom:0;">
+      <label>Host name</label>
+      <input type="text" name="name" required>
+    </div>
+    <div class="form-group" style="margin-bottom:0;">
+      <label>Address (optional)</label>
+      <input type="text" name="address">
+    </div>
+    <button type="submit" class="btn">Add host</button>
+  </form>
+</div>
+
+<div class="card-flush">
+  <table class="table">
+    <thead>
+      <tr>
+        <th>Host</th><th>Agent version</th><th>Distro</th>
+        <th>Last seen</th><th class="td-actions">Actions</th>
+      </tr>
+    </thead>
+    <tbody>
+      {% for item in registrations %}
+      <tr>
+        <td>{{ item.host.name if item.host else item.reg.host_id }}</td>
+        <td>{{ item.reg.agent_version or "—" }}</td>
+        <td>{{ item.reg.distro or "—" }}</td>
+        <td>{{ item.reg.last_seen_at.strftime("%Y-%m-%d %H:%M:%S") if item.reg.last_seen_at else "never" }}</td>
+        <td class="td-actions">
+          <form method="post" action="/plugins/host_agent/settings/{{ item.reg.host_id }}/rotate-token"
+                style="display:inline;"
+                onsubmit="return confirm('Rotate the token for this host? The existing agent will stop working until reinstalled with the new token.');">
+            <button type="submit" class="btn btn-ghost btn-sm">Rotate token</button>
+          </form>
+          <form method="post" action="/plugins/host_agent/settings/{{ item.reg.host_id }}/delete"
+                style="display:inline;"
+                onsubmit="return confirm('Delete this host registration? The agent will be unable to report metrics until re-registered.');">
+            <button type="submit" class="btn btn-danger btn-sm">Delete</button>
+          </form>
+        </td>
+      </tr>
+      {% else %}
+      <tr><td colspan="5" class="empty">No hosts registered. Add one above.</td></tr>
+      {% endfor %}
+    </tbody>
+  </table>
+</div>
+{% endblock %}

plugins/host_agent/templates/widget_history.html

@@ -0,0 +1,24 @@
+<div class="widget-history">
+  <h3>{{ host.name }} — last {{ hours }}h</h3>
+  <canvas id="host-agent-chart-{{ host.id }}" width="600" height="200"></canvas>
+  <script>
+  (function() {
+    const ctx = document.getElementById("host-agent-chart-{{ host.id }}").getContext("2d");
+    const series = {{ series|tojson }};
+    new Chart(ctx, {
+      type: "line",
+      data: {
+        datasets: [
+          { label: "CPU %",       data: series.cpu_pct.map(p => ({x: p.t, y: p.v})) },
+          { label: "Mem %",       data: series.mem_used_pct.map(p => ({x: p.t, y: p.v})) },
+          { label: "Disk % worst", data: series.disk_used_pct_worst.map(p => ({x: p.t, y: p.v})) },
+        ],
+      },
+      options: {
+        responsive: true,
+        scales: { x: { type: "time" }, y: { min: 0, max: 100 } },
+      },
+    });
+  })();
+  </script>
+</div>

plugins/host_agent/templates/widget_table.html

@@ -0,0 +1,34 @@
+{# host_agent widget — fleet glance, flex rows (no header wrap) #}
+{% if rows %}
+<div style="display:grid;gap:0.1rem;">
+  {% for r in rows %}
+  {% set stale = not r.reg.last_seen_at %}
+  <div style="display:flex;align-items:center;gap:0.6rem;font-size:0.82rem;padding:0.3rem 0;border-bottom:1px solid var(--border);">
+    <span class="dot {% if stale %}dot-dim{% elif (r.cpu_pct or 0) >= 90 or (r.mem_used_pct or 0) >= 90 or (r.disk_worst or 0) >= 90 %}dot-warn{% else %}dot-up{% endif %}"></span>
+    <a href="/plugins/host_agent/{{ r.host.id }}/"
+       style="flex:1;min-width:0;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;font-weight:500;">
+      {{ r.host.name }}
+    </a>
+    <span style="display:flex;gap:0.75rem;font-variant-numeric:tabular-nums;color:var(--text-muted);font-size:0.75rem;flex-shrink:0;">
+      {% if r.cpu_pct is not none %}
+      <span title="CPU"><span style="color:var(--text-dim);">cpu</span> {{ "%.0f"|format(r.cpu_pct) }}%</span>
+      {% endif %}
+      {% if r.mem_used_pct is not none %}
+      <span title="Memory"><span style="color:var(--text-dim);">mem</span> {{ "%.0f"|format(r.mem_used_pct) }}%</span>
+      {% endif %}
+      {% if r.disk_worst is not none %}
+      <span title="Worst disk mount"><span style="color:var(--text-dim);">disk</span> {{ "%.0f"|format(r.disk_worst) }}%</span>
+      {% endif %}
+      {% if r.load_1m is not none %}
+      <span title="Load average 1m"><span style="color:var(--text-dim);">load</span> {{ "%.2f"|format(r.load_1m) }}</span>
+      {% endif %}
+    </span>
+    <span style="min-width:60px;text-align:right;font-size:0.72rem;color:var(--text-dim);flex-shrink:0;">
+      {{ r.reg.last_seen_at.strftime("%H:%M:%S") if r.reg.last_seen_at else "never" }}
+    </span>
+  </div>
+  {% endfor %}
+</div>
+{% else %}
+<p class="empty" style="padding:0.5rem 0;font-size:0.85rem;">No hosts with agent data yet.</p>
+{% endif %}