Sensors: per-service and container sensors, pattern-limited tokens, fleet query, steady sampler

- service.<unit>.active|state for services that are enabled, up or failed
- containers.* and container.<name>.running|state|health|mem|cpu (cgroup reads, no docker stats)
- sensors:read tokens can be limited to ID patterns, enforced on every endpoint and,
  through the hub's filter header, on managed machines; the header can only narrow
- /api/fleet/sensors/query: one shaped query, every machine, one request
- the sampler waits what's left of the interval, so 250 ms means 4 a second
- Monitors asks for the families it draws instead of *
- unpowered hwmon sentinels (-93 °C) are not temperatures

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

PLAN.md

@@ -187,8 +187,8 @@ something long in one, switch away and back, refresh — it's all still there.
   on the Monitors tab (was "Dashboard"; the view id and URL are still `dashboard`), and a
   frameable `/embed/widget` for Glance and friends. The stock Monitors modules and the Disks
   tab read the sensor API too (`sampleAdapter.ts`); `/api/metrics` is retired.
-  **Remaining:** per-unit service and container sensors; pattern-restricted tokens;
-  one-request fleet query.
+  Also per-service and per-container sensors (memory and CPU from cgroups), tokens limited
+  to ID patterns, and `/api/fleet/sensors/query` for the whole fleet in one request.
 - **Multi-host** — **Phase 1 shipped 2026-09-18** (`internal/nodes`, `internal/tlsauto`,
   `MachineSwitcher.tsx`, `Machines.tsx`). One binary, hub and spoke: a host whose
   `config.json` lists `nodes` is a hub; any other is a standalone node with its full UI.