Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/tile.go

@@ -27,7 +27,7 @@ type TileEnricher struct {
 // fall back to a tile without the extra fields rather than breaking
 // the whole dashboard.
 func (e *TileEnricher) Build(ctx context.Context, host model.Host, latest *model.Run) templates.TileData {
-	t := templates.TileData{Host: host, Latest: latest}
+	t := templates.TileData{Host: host, Latest: latest, LastSeenAt: host.LastSeenAt}
 	if latest == nil {
 		return t
 	}