feat: add host system health monitoring

[makeitfutureDev]

The admin UI previously had no host resource monitoring. Add System health as the last navigation item, backed by daemon-side Linux collection rather than the standalone prototype's generated values.

The collector samples every five seconds, persists minute averages/peaks for 30 days, retains storage for 186 days with hourly compaction, and rescans hardware every five minutes or on refresh. The authenticated page supports live/pause/refresh, historical ranges, CPU/RAM and storage charts, truthful empty/error states, capacity warnings and an evidence-dependent forecast. A bounded shutdown flush preserves partial-minute peaks through restart. No container mounts, engine permissions or public health disclosures are widened.

Validation:

• Full coverage suite: 2,520 passed, 0 failed, 12 skipped; lines 92.71%, branches 84.39%, functions 88.52%.
• Static checks, secret scan, security coverage and DCO passed.
• Production dependency audit passed the high-severity gate; one existing moderate Hono advisory remains. No dependencies changed.
• Real Chromium fixture: desktop/mobile, actual samples/hardware, section order, chart keyboard tooltip, pause/manual refresh, all ranges, navigation, API failure/recovery and 85%/95% warnings passed; no page errors.
• 65-second container smoke: 13 samples, 2 persisted minutes, no errors, ~0.09% of one CPU core, ~54 MiB RSS, ~0.47 MiB DB+WAL; reopen persistence passed. This is not the 24-hour host canary.
• Synthetic full-retention fixture: 43,260 resource rows + 47,004 storage rows use ~7.3 MiB SQLite, excluding other shared gateway records.

Beta deployment was explicitly requested without waiting for the remaining tests. The 24-hour container canary was stopped early and is not recorded as passed. The target-host canary and private QA registry entry remain unexecuted; neither blocks this explicitly authorized beta deployment. Safe restart and activation verification follow the beta merge. No stable release or QA-account substitution was authorized. Cases SYS-01 through SYS-05 are documented in TEST-PLAN.md; they are engine-independent because collection and browser rendering do not invoke an engine. This PR is not a stable release request.