Sensors: read-only tokens, live stream, Prometheus, status sensors, widgets, embeds

- sensors:read tokens open the sensor endpoints (here and on managed machines
  through the hub) and nothing else; full tokens are never accepted from a URL
- /api/sensors/stream: a shaped query that keeps answering, over SSE
- /metrics: Prometheus text format
- services, updates, ZFS and SMART as background status sensors
- widget library over the sensor API; custom widgets on the dashboard
- /embed/widget: one live widget in its own bundle, the only frameable path
- Dashboard tab is now Monitors

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/config/config.go

@@ -19,8 +19,13 @@ type Token struct {
 	Name    string    `json:"name"`
 	Hash    string    `json:"hash"`
 	Created time.Time `json:"created"`
+	// Scope is what the token may do. "" is everything (a hub's token: full control of
+	// this machine). ScopeSensorsRead only reads sensors — what a dashboard gets.
+	Scope string `json:"scope,omitempty"`
 }
 
+const ScopeSensorsRead = "sensors:read"
+
 // Node is a remote Ham Lab this host (as hub) manages. The token is the one that
 // node issued to us; the fingerprint pins its self-signed certificate.
 type Node struct {