Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/web/templates/host_tile_test.go

@@ -0,0 +1,53 @@
+package templates
+
+import (
+	"testing"
+	"time"
+)
+
+func TestHumanAgoFrom(t *testing.T) {
+	now := time.Date(2026, 4, 17, 12, 0, 0, 0, time.UTC)
+	cases := []struct {
+		name string
+		ago  time.Duration
+		want string
+	}{
+		{"just now", 5 * time.Second, "online"},
+		{"edge-just-under-minute", 59 * time.Second, "online"},
+		{"one minute", 60 * time.Second, "1m ago"},
+		{"five minutes", 5 * time.Minute, "5m ago"},
+		{"fifty-nine minutes", 59 * time.Minute, "59m ago"},
+		{"one hour", 1 * time.Hour, "1h ago"},
+		{"eight hours", 8 * time.Hour, "8h ago"},
+		{"one day", 24 * time.Hour, "1d ago"},
+		{"three days", 72 * time.Hour, "3d ago"},
+		// Clock skew: "future" heartbeat clamps to "online" rather than
+		// printing "-3m ago" or panicking.
+		{"future clamps to online", -5 * time.Second, "online"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := humanAgoFrom(now, now.Add(-tc.ago))
+			if got != tc.want {
+				t.Fatalf("humanAgoFrom(%v) = %q, want %q", tc.ago, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestLastSeenLabelAndClass(t *testing.T) {
+	if got := lastSeenLabel(nil); got != "never" {
+		t.Fatalf("label nil = %q, want never", got)
+	}
+	if got := lastSeenClass(nil); got != "offline" {
+		t.Fatalf("class nil = %q, want offline", got)
+	}
+	recent := time.Now().Add(-5 * time.Second)
+	if got := lastSeenClass(&recent); got != "online" {
+		t.Fatalf("class recent = %q, want online", got)
+	}
+	stale := time.Now().Add(-10 * time.Minute)
+	if got := lastSeenClass(&stale); got != "stale" {
+		t.Fatalf("class stale = %q, want stale", got)
+	}
+}