Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/web/register/quick.sh.tmpl

@@ -16,6 +16,9 @@
 #   WOL_PORT         WoL UDP port (default: 9)
 #   NOTES            Free-text notes
 #   ORCH_URL         Override orchestrator base URL
+#   INSTALL_AGENT    1=install vetting-reporter systemd service (default)
+#                    0=skip the agent install (registration only)
+#                    Pass via:  curl ... | sudo INSTALL_AGENT=0 bash
 set -euo pipefail
 
 ORCH_URL="${ORCH_URL:-{{.OrchestratorURL}}}"
@@ -175,5 +178,52 @@ resp="$(curl -fsS -X POST \
     -d "${payload}" \
     "${ORCH_URL}/api/v1/hosts")"
 echo "OK: ${resp}"
+
+# --- Optional: install the vetting-reporter systemd service so the
+# host keeps heartbeating to the orchestrator long-term. Skipped when
+# INSTALL_AGENT=0 or when systemctl isn't present (non-systemd hosts).
+install_agent() {
+    if [[ "${INSTALL_AGENT:-1}" == "0" ]]; then
+        echo "Skipping agent install (INSTALL_AGENT=0)."
+        return
+    fi
+    if ! command -v systemctl >/dev/null 2>&1; then
+        echo "systemctl not found — skipping agent install."
+        return
+    fi
+    echo "Installing vetting-reporter service..."
+    install -d /etc/vetting /usr/local/bin
+    if ! curl -fsSL "${ORCH_URL}/assets/vetting-agent-linux-amd64" \
+            -o /usr/local/bin/vetting-agent; then
+        echo "WARN: could not download agent from ${ORCH_URL}/assets/vetting-agent-linux-amd64"
+        echo "WARN: registration succeeded but the host won't heartbeat."
+        return
+    fi
+    chmod +x /usr/local/bin/vetting-agent
+    cat >/etc/vetting/host-agent.yaml <<YAML
+orchestrator_url: "${ORCH_URL}"
+mac: "${MAC}"
+interval: "30s"
+YAML
+    cat >/etc/systemd/system/vetting-reporter.service <<'UNIT'
+[Unit]
+Description=Vetting host-mode reporter
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+ExecStart=/usr/local/bin/vetting-agent host -config /etc/vetting/host-agent.yaml
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+    systemctl daemon-reload
+    systemctl enable --now vetting-reporter.service
+    echo "vetting-reporter.service enabled."
+}
+install_agent
+
 echo
 echo "Open ${ORCH_URL}/ and click 'Start vetting' on ${NAME}."