feat(homeassistant): it shows system problems and installs updates on a weekly slot, and leaves device readings alone (#6748, #6749, #6747)

The connection's job is keeping Home Assistant running. Each poll now reads open
repairs, Supervisor health, disk, recovery mode and add-ons that should be running
over its websocket, for the page, the overview and the problems_open, disk_free_pct
and update_failed metrics. That needs a websocket client, so websockets joins the
dependencies.

A weekly slot, set on the page or through MCP and off until then, installs add-ons,
then Core, then the OS, each after its own confirmed backup, ending at the first
failure. The slot arithmetic moves from the host agent's cadence to steward.core.weekly
so both share it.

The device scrape goes: the page's Metrics section and a target's token_from from
4c9ed02 are removed, and a migration deletes targets using it, as they'd otherwise ask
with no token. A refused token still stops a scrape.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/prometheus/scheduler.py

@@ -48,33 +48,14 @@ def is_due(target, now: datetime) -> bool:
     return elapsed >= target.interval_seconds - TICK_SECONDS / 2
 
 
-def _token_source(name: str):
-    from steward.core.plugin_manager import loaded_plugin_submodule
-    return loaded_plugin_submodule(name, "metrics")
-
-
-async def target_token(app: "Quart", target, url: str) -> str:
-    """The token to ask `url` with: the target's own, or one from the plugin whose
-    sign-in it uses. Raises TokenUnavailable when that plugin has none to give."""
-    from steward.core.crypto import decrypt_secret
-    from steward.core.prometheus import TokenUnavailable
-
-    if not target.token_from:
-        return decrypt_secret(target.token, context=f"prometheus target {target.name} token")
-    source = _token_source(target.token_from)
-    if source is None:
-        raise TokenUnavailable(f"Its token comes from the {target.token_from} plugin, which isn't turned on.")
-    return await source.scrape_token(app, url)
-
-
 async def scrape_due(app: "Quart", scrape=None) -> None:
     """Scrape every due target at once, then write each one's outcome to its
     row and its series to the metric tables. `scrape` stands in for
     scraper.scrape in tests."""
-    from steward.core.prometheus import TokenUnavailable
+    from steward.core.crypto import decrypt_secret
 
     from .models import PrometheusTarget
-    from .scraper import ScrapeError, TokenRefused
+    from .scraper import ScrapeError
     from .scraper import scrape as fetch
 
     scrape = scrape or fetch
@@ -87,15 +68,11 @@ async def scrape_due(app: "Quart", scrape=None) -> None:
 
     async def one(t):
         started = time.monotonic()
-
-        async def fetched():
-            return await scrape(t.url, await target_token(app, t, t.url), t.verify_tls)
-
+        token = decrypt_secret(t.token, context=f"prometheus target {t.name} token")
         try:
-            families = await asyncio.wait_for(fetched(), SCRAPE_DEADLINE_SECONDS)
+            families = await asyncio.wait_for(scrape(t.url, token, t.verify_tls),
+                                              SCRAPE_DEADLINE_SECONDS)
             return families, (time.monotonic() - started) * 1000
-        except TokenUnavailable as exc:
-            return ScrapeError(str(exc)), (time.monotonic() - started) * 1000
         except TimeoutError:
             return ScrapeError(f"Gave up after {SCRAPE_DEADLINE_SECONDS} s."), \
                 (time.monotonic() - started) * 1000
@@ -104,11 +81,6 @@ async def scrape_due(app: "Quart", scrape=None) -> None:
 
     results = await asyncio.gather(*(one(t) for t in targets))
     await record(app, targets, results, datetime.now(timezone.utc))
-    # A refused sign-in is the lending plugin's to stop, so one Try again or sign-in
-    # there starts everything that uses it.
-    for t, (result, _) in zip(targets, results):
-        if t.token_from and isinstance(result, TokenRefused) and (source := _token_source(t.token_from)):
-            await source.token_refused(app)
 
 
 async def forget_gone(session, target: str, kept: set[tuple[str, str]]) -> None:
@@ -160,7 +132,7 @@ async def record(app: "Quart", targets, results, now: datetime) -> None:
                     if not isinstance(result, ScrapeError):
                         logger.warning("Prometheus scrape of %s failed: %r", target.name, result)
                     row.last_error = str(result) or "The scrape failed."
-                    row.refused = isinstance(result, TokenRefused) and not row.token_from
+                    row.refused = isinstance(result, TokenRefused)
                     batch.add(source_module=SOURCE, resource_name=row.name, metric_name=IS_UP,
                               value=0.0, recorded_at=now)
                     continue