slice 9: GET /host/metrics + CPU/chassis-temp collector (v0.14.0)

Add a host-wide, token-authed GET /host/metrics local-API endpoint that
re-serves the slice-4 collector's host + per-storage view to the customer
(the de-privileged controller can't read the host itself). Add the one new
collector — CPU/chassis temperature via sysfs hwmon/thermal-zones, graceful-
null — to the shared HostMetrics struct, so the hub report carries cpu_temp_c
too. Cross-repo host-report golden updated byte-identical.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/hub/report_test.go

@@ -16,6 +16,7 @@ func TestHostReport_FieldNamesAndEmptyCollections(t *testing.T) {
 			MemoryTotalBytes: 16777216000, MemoryUsedBytes: 4194304000, MemoryPercent: 25.0,
 			DiskTotalBytes: 152000000000, DiskUsedBytes: 30000000000, DiskPercent: 19.7,
 			LoadAvg: []string{"0.10", "0.20", "0.15"}, UptimeSeconds: 86400,
+			CPUTempC: intp(47), // nullable scalar — set here so the "no null" invariant stays meaningful
 		},
 		Guests: []Guest{{
 			VMID: 100, Name: "felhom-cust-acme", Status: "running", ControllerVersion: "",
@@ -37,7 +38,7 @@ func TestHostReport_FieldNamesAndEmptyCollections(t *testing.T) {
 	for _, field := range []string{
 		`"host_id":"demo-host-01"`, `"reported_at":`, `"agent_version":"0.3.0"`,
 		`"cpu_percent":3.2`, `"memory_total_bytes":16777216000`, `"loadavg":["0.10","0.20","0.15"]`,
-		`"disk_percent":19.7`, `"uptime_seconds":86400`,
+		`"disk_percent":19.7`, `"uptime_seconds":86400`, `"cpu_temp_c":47`,
 		`"vmid":100`, `"controller_version":""`, `"memory_bytes":2147483648`,
 		`"cloudflared":{"status":"active"}`,
 		// empty collections must be [] not null