Virtualization phase 2: ISOs, New VM from ISO, the VGA console in the browser, nightly exports, mounts, instance sensors

- Library: an ISO shelf in virt/isos: upload (the Files uploader), fetch by URL with an
  optional sha256, import a file from the machine by copying it in, rename, delete (refused
  while attached), attach to a VM as a CD-ROM live or stopped with boot-first, eject, and
  New VM from ISO: an empty VM with the ISO as first boot device, Secure Boot on or off.
- The VGA console: Ham Lab asks Incus for the VM's SPICE console over its unix socket and
  bridges the display websocket to the browser, where spice-html5 (vendored from upstream
  b372aab, LGPL, loaded on demand) draws it; Ctrl+Alt+Del, fit-to-window.
- Exports: every instance as a tarball in virt/exports/<name>/, kept to a count, as a cron
  line in /etc/cron.d/hamlab-virt calling hamlab virt-export, settings and the last run
  as files beside the data; Export now per instance or for all.
- Disks tab per instance: the root disk, attached ISOs with Eject, bind mounts in and out
  (shift for containers, virtiofs for VMs).
- instance.* sensors (running, down, state, cpu, mem) and the VM-or-container-down alert
  default, offered once to installs seeded before it existed.
- cloud-init: Use my SSH keys writes a cloud-config from the account's public keys.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/api/status_sensors.go

@@ -10,6 +10,7 @@ import (
 	"sync"
 	"time"
 
+	"hamlab/internal/incus"
 	"hamlab/internal/priv"
 	"hamlab/internal/sensors"
 	"hamlab/internal/storage"
@@ -54,6 +55,7 @@ func newStatusSensors(s *Server) *statusSensors {
 	p := &statusSensors{s: s, by: map[string][]sensors.Sensor{}, hist: map[string]*sensors.Series{}, acc: map[string]*bucket{}}
 	go p.loop("services", servicesEvery, p.services)
 	go p.loop("containers", containersEvery, p.containers)
+	go p.loop("instances", containersEvery, p.instances)
 	go p.loop("updates", updatesEvery, p.updates)
 	go p.loop("zfs", zfsEvery, p.zfs)
 	go p.loop("smart", smartEvery, p.smart)
@@ -320,6 +322,43 @@ type cpuMark struct {
 	t    int64
 }
 
+// instances are Incus's containers and VMs. "Down" means it should be up and is not: an
+// instance marked to start with the machine that is stopped, or one in Error — a stopped
+// instance with no such mark was stopped on purpose, as with Docker containers.
+func (p *statusSensors) instances(ctx context.Context, t int64) []sensors.Sensor {
+	if !incus.Installed() {
+		return nil
+	}
+	list, err := p.s.virt.InstancesFor(ctx, "sensors")
+	if err != nil {
+		return nil
+	}
+	var res []sensors.Sensor
+	var running, total float64
+	for _, in := range list {
+		total++
+		id := "instance." + sensors.Seg(in.Name)
+		l := map[string]string{"instance": in.Name, "type": in.Type, "image": in.Image}
+		up := in.Status == "Running"
+		if up {
+			running++
+		}
+		down := in.Status == "Error" || (!up && in.Config["boot.autostart"] == "true")
+		res = append(res,
+			sensors.Sensor{ID: id + ".running", Name: in.Name, Kind: "state", Value: up, T: t, Labels: l},
+			sensors.Sensor{ID: id + ".down", Name: in.Name + " down", Kind: "state", Value: down, T: t, Labels: l},
+			sensors.Sensor{ID: id + ".state", Name: in.Name + " state", Kind: "state", Value: strings.ToLower(in.Status), T: t, Labels: l})
+		if up {
+			res = append(res,
+				sensors.Sensor{ID: id + ".cpu", Name: in.Name + " CPU", Kind: "usage", Unit: "%", Value: float64(int(in.CPUPct*10+0.5)) / 10, T: t, Min: sensors.F(0), Labels: l},
+				sensors.Sensor{ID: id + ".mem", Name: in.Name + " memory", Kind: "bytes", Unit: "B", Value: float64(in.MemUsage), T: t, Labels: l})
+		}
+	}
+	return append(res,
+		sensors.Sensor{ID: "instances.total", Name: "Instances", Kind: "count", Value: total, T: t},
+		sensors.Sensor{ID: "instances.running", Name: "Running instances", Kind: "count", Value: running, T: t})
+}
+
 func (p *statusSensors) updates(ctx context.Context, t int64) []sensors.Sensor {
 	st := p.s.updates.Status(ctx)
 	if st.Manager == "" {