Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/config/config.go

@@ -16,6 +16,7 @@ type Config struct {
 	Janitor    Janitor    `yaml:"janitor"`
 	PXE        PXE        `yaml:"pxe"`
 	Network    Network    `yaml:"network"`
+	Agent      Agent      `yaml:"agent"`
 	Notifiers  []Notifier `yaml:"notifiers"`
 	Routes     []Route    `yaml:"routes"`
 }
@@ -70,6 +71,14 @@ type PXE struct {
 	LiveDir         string `yaml:"live_dir"`  // holds vmlinuz + initrd.img; served at /live
 }
 
+// Agent holds settings related to the host-mode vetting-agent binary
+// that operators install on their hosts. AssetDir is served at
+// /assets/*, which is where the quick-register script downloads
+// `vetting-agent-linux-amd64` from.
+type Agent struct {
+	AssetDir string `yaml:"asset_dir"` // directory containing vetting-agent-linux-amd64; "" disables /assets
+}
+
 type Notifier struct {
 	Name       string `yaml:"name"`
 	Type       string `yaml:"type"`