feat(observability): restore monitoring coverage, make gaps visible, stream executions

Monitoring coverage was 3 of 89 active entities. Three bugs, each hidden by
discarded errors in checkdefaults:

- writeCheck generated a fresh uuid, inserted the check entity ON CONFLICT
  (slug) DO NOTHING, then wrote a check_defs row referencing it. On any
  re-seed the slug already existed, the entity insert no-oped, and the FK
  violated — aborting the ingest transaction and surfacing as an unrelated
  failure several entities later. Re-seeding has been broken since; prod's
  coverage was frozen at its first successful seed. This is what
  TestSeedIngestIdempotentAndNoDuplicateEdges had been reporting.
- shortSlug truncated to the last 8 chars, so all 21 ingress routes collapsed
  to ".network" and overwrote each other; service:jellyfin collided with
  lxc:jellyfin.
- The ssh-script checker never read the `args` config checkdefaults wrote, so
  process_check.sh always ran without its unit name and returned "unknown".

Coverage is now 75/89. Monitoring is declared per entity type in
seeds/ontology.yaml and resolved through the is-a hierarchy, so a type can say
it warrants nothing (site, lan, mesh, cluster) and never be reported as a gap.
coverageSweep raises an `unmonitored` signal only where a type declares
monitoring it lacks — 8 real gaps, no false positives.

Also:
- entity_types.attribute_schema was never ingested: the seed loader read
  "attribute_schema" but the YAML says "attributes", so all 60 types stored
  JSON null.
- ListExecutions ignored its declared target/action/correlation_id filters and
  paginated on a non-unique target slug, dropping and repeating rows.
- started_at was captured but only written at terminal state, so a running
  execution reported NULL for its whole life. The three MCP auto-run copies
  wrote no timing at all; they are now one autoRun helper.
- SSH output was buffered to completion and discarded entirely on timeout.
  Both sshExec copies now stream through a shared execlog sink into
  execution_logs, and keep partial output when a command is cancelled.
- executions.correlation_id was a random per-execution uuid that correlated
  nothing; it is now the chat session id, which is what lets the chat tail
  live output.
- reversible_low had no auto-run branch despite policy declaring it
  unattended. Since computeCommandRisk never returns it, the class only arises
  when an agent declares it over a read_only command — so gating it penalised
  candor without adding safety.
- backup-target gains a backup-freshness checker (portable find -mmin, since
  the first target is on macOS), resolving its host by walking backs-up-to
  backwards. The pre-deploy pg_dump is now a tracked backup target.

UI: an Executions section on entity detail with live output tailing, and
streamed output under a running `run` call in the chat timeline.

Migrations 022-024. Ops.svelte and context.ts exclude execution.output from
their refetch triggers, which would otherwise fire once a second per command.

Co-Authored-By: Claude <noreply@anthropic.com>

internal/httpapi/server.go

@@ -111,6 +111,7 @@ func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config) http.Hand
 	//   /api/v1/knowledge/content/{id} — returns raw markdown, not a gen type
 	//   /api/v1/activity/recent        — recency-ordered, not paginated
 	//   /api/v1/activity/session/{id}  — session-scoped aggregation
+	//   /api/v1/executions/{id}/logs   — streamed command output, no schema type
 	//   /api/v1/learning/timeline      — derived view, no backing schema type
 	//   /api/v1/learning/trend         — derived view, no backing schema type
 	//
@@ -207,6 +208,11 @@ func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config) http.Hand
 	// per-session "what did this session do" digest.
 	// (See "Non-OpenAPI routes" carve-out block above.)
 	r.With(combinedAuth(cfg, false)).Get("/api/v1/activity/recent", s.serveRecentActivity)
+	// Streamed command output for one execution — a projection over
+	// execution_logs with no schema type yet (same carve-out rationale as
+	// /activity/recent above). Nests cleanly under the generated
+	// /executions/{id} subtree: chi accepts sibling children on a param node.
+	r.With(combinedAuth(cfg, false)).Get("/api/v1/executions/{id}/logs", s.serveExecutionLogs)
 	r.With(combinedAuth(cfg, false)).Get("/api/v1/activity/session/{id}", s.serveSessionDigest)
 
 	// Learning view: capability timeline + success trend, both derived from
@@ -349,10 +355,10 @@ func staticTokenActor(cfg config.Config, raw string) (actor, bool) {
 // jwtVerificationKey holds a parsed RSA public key or HMAC secret for JWT
 // verification, identified by its key ID (kid).
 type jwtVerificationKey struct {
-	Kid     string
-	Alg     string
-	Key     any // *rsa.PublicKey or []byte for HMAC
-	IsHMAC  bool
+	Kid    string
+	Alg    string
+	Key    any // *rsa.PublicKey or []byte for HMAC
+	IsHMAC bool
 }
 
 // discoverJWKSURI fetches the OIDC discovery document and extracts the
@@ -598,8 +604,8 @@ func resolveOIDCTokenURL(issuer string) string {
 func (s *Server) serveOIDCConfig(w http.ResponseWriter, _ *http.Request, cfg config.Config) {
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]string{
-		"issuer":                cfg.OIDCIssuer,
-		"client_id":             cfg.OIDCClientID,
+		"issuer":                 cfg.OIDCIssuer,
+		"client_id":              cfg.OIDCClientID,
 		"authorization_endpoint": resolveOIDCEndpointURL(cfg.OIDCIssuer, "/authorize/"),
 	})
 }
@@ -863,4 +869,4 @@ func ListenAndServe(ctx context.Context, pool *db.Pool, cfg config.Config) error
 		defer cancel()
 		return srv.Shutdown(shutdownCtx)
 	}
-}
+}