Sensors: per-service and container sensors, pattern-limited tokens, fleet query, steady sampler

- service.<unit>.active|state for services that are enabled, up or failed
- containers.* and container.<name>.running|state|health|mem|cpu (cgroup reads, no docker stats)
- sensors:read tokens can be limited to ID patterns, enforced on every endpoint and,
  through the hub's filter header, on managed machines; the header can only narrow
- /api/fleet/sensors/query: one shaped query, every machine, one request
- the sampler waits what's left of the interval, so 250 ms means 4 a second
- Monitors asks for the families it draws instead of *
- unpowered hwmon sentinels (-93 °C) are not temperatures

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/config/config.go

@@ -22,6 +22,8 @@ type Token struct {
 	// Scope is what the token may do. "" is everything (a hub's token: full control of
 	// this machine). ScopeSensorsRead only reads sensors — what a dashboard gets.
 	Scope string `json:"scope,omitempty"`
+	// Sensors narrows a sensors:read token to the IDs these patterns match. Empty is all.
+	Sensors []string `json:"sensors,omitempty"`
 }
 
 const ScopeSensorsRead = "sensors:read"