Sensors: per-service and container sensors, pattern-limited tokens, fleet query, steady sampler

- service.<unit>.active|state for services that are enabled, up or failed
- containers.* and container.<name>.running|state|health|mem|cpu (cgroup reads, no docker stats)
- sensors:read tokens can be limited to ID patterns, enforced on every endpoint and,
  through the hub's filter header, on managed machines; the header can only narrow
- /api/fleet/sensors/query: one shaped query, every machine, one request
- the sampler waits what's left of the interval, so 250 ms means 4 a second
- Monitors asks for the families it draws instead of *
- unpowered hwmon sentinels (-93 °C) are not temperatures

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/nodes/nodes.go

@@ -381,6 +381,40 @@ func (m *Manager) PushAll(ctx context.Context, binPath, ourArch string, force bo
 // Proxy returns the handler for /api/nodes/<name>/<rest>: it rewrites to <node>/api/<rest>,
 // swaps the hub's cookie for the node's bearer token, and drops Origin so the node's
 // WebSocket origin check (meant for browsers) doesn't reject the hub.
+// Do makes one request to a managed machine as this hub and returns the whole response.
+func (m *Manager) Do(ctx context.Context, name, method, path string, body []byte, hdr http.Header) (int, []byte, error) {
+	n, ok := m.node(name)
+	if !ok {
+		return 0, nil, errors.New("no such machine")
+	}
+	req, err := http.NewRequestWithContext(ctx, method, strings.TrimRight(n.URL, "/")+path, bytes.NewReader(body))
+	if err != nil {
+		return 0, nil, err
+	}
+	for k, v := range hdr {
+		req.Header[k] = v
+	}
+	req.Header.Set("Authorization", "Bearer "+n.Token)
+	resp, err := m.client(n).Do(req)
+	if err != nil {
+		return 0, nil, errors.New(shortErr(err))
+	}
+	defer resp.Body.Close()
+	b, err := io.ReadAll(io.LimitReader(resp.Body, 8<<20))
+	return resp.StatusCode, b, err
+}
+
+// Names lists the managed machines.
+func (m *Manager) Names() []string {
+	var out []string
+	m.cfg.View(func(c *config.Config) {
+		for _, n := range c.Nodes {
+			out = append(out, n.Name)
+		}
+	})
+	return out
+}
+
 func (m *Manager) Proxy(name string) (http.Handler, bool) {
 	n, ok := m.node(name)
 	if !ok {