Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/web/templates/dashboard.templ

@@ -1,15 +1,21 @@
 package templates
 
-import "vetting/internal/model"
+import (
+	"time"
+
+	"vetting/internal/model"
+)
 
 // TileData pairs a host with its latest run and the derived fields the
 // tile needs to render: spec-diff count (server-side diff result) and
 // the on-disk path to the hold-key artifact when the run is holding.
+// LastSeenAt is the host-mode agent's most recent heartbeat.
 type TileData struct {
 	Host             model.Host
 	Latest           *model.Run
 	SpecDiffCritical int
 	HoldKeyPath      string
+	LastSeenAt       *time.Time
 }
 
 templ Dashboard(tiles []TileData) {