Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/web/static/app.css

@@ -107,9 +107,30 @@ button.danger:hover { background: rgba(229,100,102,.1); }
 }
 .tile-head { display: flex; justify-content: space-between; align-items: center; }
 .tile-name { font-weight: 600; }
+.tile-header-right { display: flex; align-items: center; gap: 10px; }
 .tile-status { font-size: 12px; color: var(--text-dim); text-transform: uppercase; letter-spacing: .5px; }
 .tile-idle .tile-status { color: var(--text-dim); }
 
+.tile-last-seen {
+  font-family: var(--mono);
+  font-size: 11px;
+  color: var(--text-dim);
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+}
+.tile-last-seen::before {
+  content: "";
+  width: 6px;
+  height: 6px;
+  border-radius: 50%;
+  background: var(--text-dim);
+}
+.tile-last-seen.online { color: var(--success); }
+.tile-last-seen.online::before { background: var(--success); }
+.tile-last-seen.stale::before { background: var(--warn); }
+.tile-last-seen.offline::before { background: var(--text-dim); opacity: .5; }
+
 .tile-meta { display: grid; grid-template-columns: 1fr 1fr; gap: 4px 16px; margin: 0; font-size: 13px; }
 .tile-meta div { display: flex; justify-content: space-between; align-items: baseline; }
 .tile-meta dt { color: var(--text-dim); }