fix: metric samples timestamp + ssh-script port/user handling

- InsertMetricSample now includes ts=now() (TimescaleDB hypertable requires it)
- ssh-script: pass host and port separately (ssh uses -p flag, not host:port)
- ssh-script: use OIKOS_SSH_USER from config/env, default root
- Add -o LogLevel=ERROR to suppress SSH warnings polluting JSON output
- Use Output() (stdout only) instead of CombinedOutput()
- Set OIKOS_SSH_USER=root in scheduler docker-compose service

internal/db/queries/operations.sql

@@ -240,8 +240,8 @@ SELECT * FROM risk_classes ORDER BY name;
 SELECT * FROM approval_rules ORDER BY entity_type, action;
 
 -- name: InsertMetricSample :exec
-INSERT INTO metric_samples (entity_id, metric, value, tags)
-VALUES ($1, $2, $3, $4);
+INSERT INTO metric_samples (entity_id, metric, value, tags, ts)
+VALUES ($1, $2, $3, $4, now());
 
 -- name: QueryMetrics :many
 SELECT time_bucket(sqlc.arg('bucket_interval')::interval, ts) AS bucket,