scheduler: add ping + ssh-script check kinds, metrics refactor, 17 host check scripts

- Refactor executeCheck to return checkResult struct with metrics map
- Add ping check kind (ICMP reachability via system ping, macOS+Linux)
- Add ssh-script check kind (remote host exec via SSH, allowlisted scripts)
- Add threshold evaluation (warn/crit per metric from check config JSONB)
- Add inode tracking to disk check
- All 4 existing checks now return structured metrics
- 17 check scripts: cpu, memory, load, swap, disk_usage, disk_smart,
  updates, zfs, process, uptime, oom, journal, time, fd, docker_health,
  caddy_error_rate, backup_freshness
- Auto-deploy via tools/setup-checks.sh -> checks/install.sh on git pull
- Add ping to OpenAPI CheckKind enum and generated Go types

checks/backup_freshness.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# backup_freshness.sh — check that backups exist and are recent.
+set -euo pipefail
+
+BACKUP_DIRS="${OIKOS_BACKUP_DIRS:-/var/backups /opt/backups /mnt/backups}"
+GRACE_HOURS="${OIKOS_BACKUP_GRACE:-48}"
+STALE=""
+
+for dir in $BACKUP_DIRS; do
+  [ -d "$dir" ] || continue
+  NEWEST=$(find "$dir" -type f -mmin -$((GRACE_HOURS * 60)) 2>/dev/null | head -1 || true)
+  if [ -z "$NEWEST" ]; then
+    LATEST_TS=$(find "$dir" -type f -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1 | awk '{print $1}' || echo "0")
+    LATEST_HOURS=$(awk "BEGIN {printf \"%.0f\", ($(date +%s) - ${LATEST_TS:-0})/3600}")
+    STALE="$STALE $dir(${LATEST_HOURS}h)"
+  fi
+done
+
+if [ -n "$STALE" ]; then
+  echo "{\"health\":\"degraded\",\"signalKind\":\"backup-stale\",\"evidence\":\"stale backups:$(echo "$STALE" | sed 's/ /, /g')\"}"
+else
+  echo '{"health":"healthy"}'
+fi