Sensors: read-only tokens, live stream, Prometheus, status sensors, widgets, embeds

- sensors:read tokens open the sensor endpoints (here and on managed machines
  through the hub) and nothing else; full tokens are never accepted from a URL
- /api/sensors/stream: a shaped query that keeps answering, over SSE
- /metrics: Prometheus text format
- services, updates, ZFS and SMART as background status sensors
- widget library over the sensor API; custom widgets on the dashboard
- /embed/widget: one live widget in its own bundle, the only frameable path
- Dashboard tab is now Monitors

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/sensors/sensors.go

@@ -51,6 +51,22 @@ type Historian interface {
 	SensorHistory(id string) (s Series, ok bool)
 }
 
+// Ticker is a Provider that can say when its values have changed.
+type Ticker interface {
+	Subscribe() (tick <-chan struct{}, cancel func())
+}
+
+// Subscribe follows the first provider that ticks. ok is false when none does.
+func (r *Registry) Subscribe() (tick <-chan struct{}, cancel func(), ok bool) {
+	for _, p := range r.providers {
+		if t, is := p.(Ticker); is {
+			tick, cancel = t.Subscribe()
+			return tick, cancel, true
+		}
+	}
+	return nil, nil, false
+}
+
 // F is a pointer to a float, for the optional bounds.
 func F(v float64) *float64 { return &v }