v0.55.0: raw-device discovery + registry-sourced drive tracking (Impl-2a)

GET /disks/candidates enumerates host disks the Impl-1 unclaimed filter proves
free (init/attach split). RegistryKnownTargets sources the watchdog's known-drive
set from the intent registry + Felhom .mount units (not Observe/PVE storages) —
decouples drive health from PVE storage (closes the registry-only false-detach
class); Observe kept for real PVE storages + a deduped /disks union. Idempotent
existing-drive migration at start. Tests + red-proof (Observe misses a
registry-only drive; registry provider tracks it). go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/localapi/server.go

@@ -70,6 +70,9 @@ type Options struct {
 	Backups    BackupService
 	Store      BackupStore
 	Storage    StorageView
+	// DriveTargets (Impl-2a, optional) yields registry+units-sourced drives for the /disks view, so a
+	// drive with NO PVE storage still appears. Unioned with Storage.Observe (deduped by mount path).
+	DriveTargets storage.KnownTargets
 	Tokens     TokenAuthority
 	// BackupCadence is the per-guest backup interval driving GET /backup/due (slice 8B). A guest
 	// is "due" when no successful backup is recorded OR the newest one is older than this. 0 → a
@@ -154,7 +157,8 @@ type Server struct {
 	guests  GuestAPI
 	backups BackupService
 	store   BackupStore
-	storage StorageView
+	storage      StorageView
+	driveTargets storage.KnownTargets // Impl-2a: registry+units drives for /disks (optional)
 	tokens  TokenAuthority
 	cadence time.Duration
 	logger  *slog.Logger
@@ -226,6 +230,7 @@ func NewServer(o Options) (*Server, error) {
 		backups:      o.Backups,
 		store:        o.Store,
 		storage:      o.Storage,
+		driveTargets: o.DriveTargets,
 		tokens:       o.Tokens,
 		cadence:      cadence,
 		logger:       o.Logger,
@@ -270,6 +275,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /host/metrics", s.withGuest(s.handleHostMetrics))
 	// Disk management (slice 8C) — self-scoped; format routes through the data-bearing classifier+gate.
 	mux.HandleFunc("GET /disks", s.withGuest(s.handleDisks))
+	mux.HandleFunc("GET /disks/candidates", s.withGuest(s.handleDiskCandidates))
 	mux.HandleFunc("POST /disks/assign", s.withGuest(s.handleDiskAssign))
 	mux.HandleFunc("POST /disks/eject", s.withGuest(s.handleDiskEject))
 	mux.HandleFunc("POST /disks/decommission", s.withGuest(s.handleDiskDecommission))