fix(checks): process_check matches docker containers + prefixed systemd units

process_check.sh ran `systemctl is-active <entity-name>`, but a service's name
is a logical label, not its unit/container name — matrix is matrix-synapse.service
+ element-web/mautrix-* containers, authentik is authentik-server/-worker
containers. So every multi-component or docker service reported "inactive"
while up (authentik, matrix, photos, house, arr-stack, …).

Resolve in order: exact systemd unit, a unit with the name as prefix
(matrix -> matrix-synapse.service), or a running docker container whose name
contains it. checkdefaults passes a declared probe_unit/systemd_unit/container
attribute when set, for precision.

internal/checkdefaults/defaults.go

@@ -202,12 +202,26 @@ func buildKind(kind string, t Target, attrs map[string]any, host, user string, p
 		if host == "" {
 			return nil, "no address on the entity or its host"
 		}
-		if t.Name == "" {
+		// A service's name is a logical label, not usually its systemd unit
+		// or container name (matrix = matrix-synapse.service + containers).
+		// Prefer an explicit probe target when declared; process_check.sh also
+		// matches a unit prefix or a docker container as a fallback.
+		unit := ""
+		for _, key := range []string{"probe_unit", "systemd_unit", "container"} {
+			if v, _ := attrs[key].(string); v != "" {
+				unit = v
+				break
+			}
+		}
+		if unit == "" {
+			unit = t.Name
+		}
+		if unit == "" {
 			return nil, "no name to check a process for"
 		}
-		// process_check.sh takes the unit name as $1 and reports "unknown"
-		// without it.
-		return []checkDef{ssh("process_check.sh", t.Name)}, ""
+		// process_check.sh takes the unit/container name as $1 and reports
+		// "unknown" without it.
+		return []checkDef{ssh("process_check.sh", unit)}, ""
 
 	case KindBackup:
 		// A backup target is checked from the machine that writes to it, so it