feat: add host_agent plugin — push-model host resource monitoring

Lightweight stdlib-only Python agent runs on each monitored host,
collects CPU / memory / disk / load / uptime from /proc every 30s,
and POSTs signed payloads to the Roundtable ingest endpoint. One-line
curl-pipe installer creates a hardened systemd unit; admin UI manages
host registrations with rotate / revoke.

- agent.py: 370 LoC single-file daemon, ring buffer + exponential backoff
- ingest route: bearer-token auth, metric expansion into plugin_metrics
- install.sh.j2: systemd unit with NoNewPrivileges / ProtectSystem / ProtectHome
- settings UI: add host / rotate token / delete registration (admin-only)
- dashboard widgets: fleet-glance table + per-host history chart
- stale-agent scheduler: 60s log warning for agents past 180s silence

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

host_agent/templates/widget_history.html

@@ -0,0 +1,24 @@
+<div class="widget-history">
+  <h3>{{ host.name }} — last {{ hours }}h</h3>
+  <canvas id="host-agent-chart-{{ host.id }}" width="600" height="200"></canvas>
+  <script>
+  (function() {
+    const ctx = document.getElementById("host-agent-chart-{{ host.id }}").getContext("2d");
+    const series = {{ series|tojson }};
+    new Chart(ctx, {
+      type: "line",
+      data: {
+        datasets: [
+          { label: "CPU %",       data: series.cpu_pct.map(p => ({x: p.t, y: p.v})) },
+          { label: "Mem %",       data: series.mem_used_pct.map(p => ({x: p.t, y: p.v})) },
+          { label: "Disk % worst", data: series.disk_used_pct_worst.map(p => ({x: p.t, y: p.v})) },
+        ],
+      },
+      options: {
+        responsive: true,
+        scales: { x: { type: "time" }, y: { min: 0, max: 100 } },
+      },
+    });
+  })();
+  </script>
+</div>