fix: blast radius walks dependency direction, and reachability survives no ICMP

Two things the entity window redesign surfaced but deliberately left alone.

**blast_radius answered the wrong question.** It walked source→target for every
relationship type, but which end of an edge is the dependent differs per type:
"machine hosts container" means the target breaks, while "service depends-on
service" and "ingress routes-to service" mean the SOURCE breaks. Walking
everything forwards was right for hosts/provides and backwards for everything
else — and swept in 2,800+ documents/involves/targets edges of pure bookkeeping,
so the result contained tasks and executions that cannot break.

Direction is now declared per relationship type in seeds/ontology.yaml
(blast_direction: forward | backward | none), the same shape as the entity
types' monitoring: declaration, and defaults to none so an undeclared edge
contributes nothing rather than a confidently wrong answer.

It also needed a modelling fix: `routes-to` names an ingress's BACKEND, so
nothing recorded that all 21 public hostnames are terminated by caddy. A
`served-by` edge type now says so.

  pool:ludo-lvm    2 -> 23   (every container storing on it, then their services)
  lxc:caddy        4 -> 22   (service:caddy, then all 21 ingress routes)
  service:authentik      7   (what authenticates via it)

**Every ping check was reporting down.** Not a host:strong false positive: all
seven, including ws:mac-mini — the Docker host itself. The scheduler runs in
Docker on macOS, whose VM does not route ICMP to the LAN; loopback pings succeed
and every LAN ping fails. Under health aggregation each broken probe dragged its
entity to down.

The question the check exists to answer is "is it reachable", and ICMP is only
one way to ask it. checkPing now falls back to a TCP connect before concluding
anything, which restores an honest verdict for the four hosts that are genuinely
up while leaving the genuinely unreachable ones down.

TestBlastRadiusTerminatesOnCycles asserted the old direction (caddy=1,
authentik=2 — the cycle walked the wrong way); it now asserts the corrected
depths, and its exact-node-count check is relaxed because walking the right way
also surfaces the seed's own real dependents, which are correct answers.

Co-Authored-By: Claude <noreply@anthropic.com>

seeds/ontology.yaml

@@ -699,36 +699,42 @@ relationship_types:
     target: compute-entity
     cardinality: one-to-many
     description: Machine hosts a VM/container (hubris hosts lxc:apps).
+    blast_direction: forward
   runs-hypervisor:
     inverse: hypervisor-on
     source: machine
     target: hypervisor
     cardinality: one-to-one
     description: Machine runs hypervisor software.
+    blast_direction: forward
   member-of:
     inverse: has-member
     source: proxmox-host
     target: cluster
     cardinality: many-to-one
     description: PVE host belongs to a cluster.
+    blast_direction: backward
   part-of:
     inverse: comprises
     source: docker-container
     target: compose-stack
     cardinality: many-to-one
     description: Docker container belongs to a compose stack.
+    blast_direction: backward
   provides:
     inverse: provided-by
     source: compute-entity
     target: service
     cardinality: one-to-many
     description: Compute entity provides a service (lxc:gitea provides service:gitea).
+    blast_direction: forward
   runs:
     inverse: run-by
     source: service
     target: application
     cardinality: one-to-many
     description: Service runs an application.
+    blast_direction: backward
   configured-by:
     inverse: configures
     source: entity
@@ -741,36 +747,52 @@ relationship_types:
     target: entity
     cardinality: many-to-one
     description: Pipeline deploys to a service/host.
+    blast_direction: forward
   routes-to:
     inverse: routed-via
     source: ingress-route
     target: service
     cardinality: many-to-one
     description: Public hostname routes to a service.
+    blast_direction: backward
+  served-by:
+    inverse: serves
+    source: ingress-route
+    target: service
+    cardinality: many-to-one
+    description: Ingress route is terminated by this reverse proxy. Distinct
+      from routes-to, which names the BACKEND the route forwards to — without
+      this edge the proxy's blast radius is invisible, and lxc:caddy reported
+      one affected entity despite terminating every *.hubris.network route.
+    blast_direction: backward
   secured-by:
     inverse: secures
     source: ingress-route
     target: identity-provider
     cardinality: many-to-one
     description: Route gated by forward-auth.
+    blast_direction: backward
   uses-certificate:
     inverse: certifies
     source: ingress-route
     target: certificate
     cardinality: many-to-one
     description: Route served with this certificate.
+    blast_direction: backward
   authenticates-via:
     inverse: authenticates-service
     source: service
     target: identity-provider
     cardinality: many-to-one
     description: Service uses native OIDC (jellyfin authenticates-via authentik).
+    blast_direction: backward
   in-zone:
     inverse: contains-record
     source: dns-record
     target: dns-zone
     cardinality: many-to-one
     description: Record belongs to a zone.
+    blast_direction: backward
   resolves-to:
     inverse: resolved-from
     source: dns-record
@@ -783,24 +805,28 @@ relationship_types:
     target: service
     cardinality: many-to-many
     description: Runtime dependency (blast-radius edge).
+    blast_direction: backward
   connects-via:
     inverse: connects
     source: compute-entity
     target: network
     cardinality: many-to-many
     description: Coarse network membership (host on LAN / mesh).
+    blast_direction: backward
   has-interface:
     inverse: interface-of
     source: compute-entity
     target: network-interface
     cardinality: one-to-many
     description: Optional per-interface refinement.
+    blast_direction: backward
   interface-on:
     inverse: has-endpoint
     source: network-interface
     target: network
     cardinality: many-to-one
     description: Interface attaches to a network.
+    blast_direction: backward
 
   # Storage
   mounts:
@@ -810,24 +836,28 @@ relationship_types:
     cardinality: many-to-many
     description: Compute entity mounts a volume. Edge attributes carry
       mount_point and options.
+    blast_direction: backward
   stores-on:
     inverse: stores-for
     source: compute-entity
     target: storage-pool
     cardinality: many-to-many
     description: Rootfs/data lives on a pool.
+    blast_direction: backward
   contains:
     inverse: contained-in
     source: storage-pool
     target: volume
     cardinality: one-to-many
     description: Pool contains a volume.
+    blast_direction: forward
   holds-dataset:
     inverse: dataset-on
     source: volume
     target: dataset
     cardinality: one-to-many
     description: Volume holds a tracked dataset.
+    blast_direction: backward
   backs-up-to:
     inverse: backup-of
     source: entity
@@ -842,12 +872,14 @@ relationship_types:
     target: ups
     cardinality: many-to-one
     description: Machine on UPS power.
+    blast_direction: backward
   located-at:
     inverse: location-of
     source: machine
     target: site
     cardinality: many-to-one
     description: Machine's physical site.
+    blast_direction: backward
   registered-with:
     inverse: registrar-of
     source: domain-registration
@@ -880,12 +912,14 @@ relationship_types:
     target: secret
     cardinality: many-to-one
     description: Grant covers a secret.
+    blast_direction: forward
   can-decrypt:
     inverse: readable-by
     source: compute-entity
     target: secret
     cardinality: many-to-many
     description: Host can decrypt a secret (legacy SOPS; Infisical grants later).
+    blast_direction: backward
 
   # Cognition
   checks: