feat(homeassistant): it shows system problems and installs updates on a weekly slot, and leaves device readings alone (#6748, #6749, #6747)

The connection's job is keeping Home Assistant running. Each poll now reads open
repairs, Supervisor health, disk, recovery mode and add-ons that should be running
over its websocket, for the page, the overview and the problems_open, disk_free_pct
and update_failed metrics. That needs a websocket client, so websockets joins the
dependencies.

A weekly slot, set on the page or through MCP and off until then, installs add-ons,
then Core, then the OS, each after its own confirmed backup, ending at the first
failure. The slot arithmetic moves from the host agent's cadence to steward.core.weekly
so both share it.

The device scrape goes: the page's Metrics section and a target's token_from from
4c9ed02 are removed, and a migration deletes targets using it, as they'd otherwise ask
with no token. A refused token still stops a scrape.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/prometheus/routes.py

@@ -12,14 +12,13 @@ from sqlalchemy import delete, func, select, update
 
 from steward.auth.middleware import require_role
 from steward.core.audit import log_audit
+from steward.core.crypto import decrypt_secret
 from steward.core.metric_series import latest_values, points
-from steward.core.prometheus import TokenUnavailable
 from steward.models.metrics import PluginMetric, PluginMetricLatest
 from steward.models.users import UserRole
 
 from . import library
 from .models import PrometheusTarget, PrometheusWidgetTemplate
-from .scheduler import target_token
 from .scraper import ScrapeError, scrape
 from .service import (OWN_METRICS, SOURCE, FormError, fold_states, form_values, is_moment, map_families,
                       parse_form, patterns, shown_value, target_state)
@@ -81,8 +80,7 @@ def _typed(form, target: PrometheusTarget | None = None) -> dict:
     return {"name": form.get("name", ""), "url": form.get("url", ""),
             "interval_seconds": form.get("interval_seconds", ""), "series_cap": form.get("series_cap", ""),
             "keep": form.get("keep", ""), "drop": form.get("drop", ""),
-            "verify_tls": bool(form.get("verify_tls")), "has_token": bool(target and target.token),
-            "token_from": target.token_from if target else None}
+            "verify_tls": bool(form.get("verify_tls")), "has_token": bool(target and target.token)}
 
 
 async def _name_taken(db, name: str, other_than: str | None = None) -> bool:
@@ -237,15 +235,10 @@ async def test_target():
             existing = await db.get(PrometheusTarget, form["target_id"])
     url = (form.get("url") or "").strip()
     token = (form.get("token") or "").strip()
+    if not token and existing is not None and existing.token and not form.get("clear_token"):
+        token = decrypt_secret(existing.token, context=f"prometheus target {existing.name} token")
     found: dict = {}
-    if not token and existing is not None and not form.get("clear_token"):
-        try:
-            token = await target_token(current_app, existing, url)
-        except TokenUnavailable as exc:
-            found["error"] = str(exc)
-    if found:
-        pass
-    elif not url.startswith(("http://", "https://")):
+    if not url.startswith(("http://", "https://")):
         found["error"] = "Enter the address first: http://… or https://…"
     else:
         try: