onboarding: auto-create default checks when entity is created

Three insertion points:
- CreateEntity (POST /api/v1/entities)
- EnrollClient (POST /api/v1/clients/enroll)
- seed.go (seed ingest at deploy time)

Shared logic in internal/checkdefaults — resolves host IP from
lan_ip > mesh.netbird.ip > mesh_ip, SSH user/port from attributes.

Default checks per entity type:
- proxmox-host/standalone-server: ping + cpu + memory + load + disk + updates
- workstation: ping + cpu + memory + load
- lxc: cpu + memory + load + disk
- vm: ping
- service: process_check.sh

All idempotent (ON CONFLICT DO NOTHING). New machines now get
monitoring automatically — no manual curl calls needed.

internal/httpapi/default_checks.go

@@ -0,0 +1,13 @@
+package httpapi
+
+import (
+	"context"
+
+	"github.com/dtoro/oikos/internal/checkdefaults"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+)
+
+func ensureDefaultChecks(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, slug, entityType string, attrsJSON []byte) {
+	checkdefaults.Ensure(ctx, tx, entityID, slug, entityType, attrsJSON)
+}

internal/httpapi/impl.go

@@ -955,6 +955,8 @@ func (s *Server) CreateEntity(ctx context.Context, req gen.CreateEntityRequestOb
 		return nil, eventErr
 	}
 
+	ensureDefaultChecks(ctx, tx, inserted.ID, slug, req.Body.Type, attrsJSON)
+
 	if err := tx.Commit(ctx); err != nil {
 		return nil, err
 	}
@@ -1219,6 +1221,8 @@ func (s *Server) EnrollClient(ctx context.Context, req gen.EnrollClientRequestOb
 		"info", "oikos-api", "",
 		map[string]any{"slug": req.Body.Slug, "type": current.Type})
 
+	ensureDefaultChecks(ctx, tx, id, req.Body.Slug, current.Type, attrsJSON)
+
 	if err := tx.Commit(ctx); err != nil {
 		return nil, err
 	}