Add drift detection and removal as a real deployment

A drift deployment scans each server's sp/ tree for files not in the
server_scripts inventory (untracked scripts left over from before EC was
managing the fleet), deletes them, and records the removed bytes in
deployment_files for audit. The existing sweep then runs the standard
wait-for-empty → Komodo restart cycle on each affected server.

To make that cycle safer, the sweep now has a second phase: after Komodo
restart succeeds we wait for komodoInspectHealthy + RCON to both come
back green before marking the deployment_server row 'done'. If either
stays broken the row stays pending and keeps retrying.

New: /api/drift (GET scan, POST run), drift panel on /deployments.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/unit/sweep.test.ts

@@ -53,6 +53,6 @@ describe('sweep', () => {
         await seedServerRegistry();
 
         const result = await sweep();
-        expect(result).toEqual({ checked: 0, restarted: 0, held: 0, failed: 0 });
+        expect(result).toEqual({ checked: 0, restarted: 0, healthy: 0, held: 0, failed: 0 });
     });
 });