R-528: the 30-s OOM scan also reads the host's per-container kernel counter (agent GET /guest/oom-kills)

A count above 0 in a running container's current run fires the existing app_oom line (source cgroup/docker in the
details), whatever Docker's OOMKilled says. Old agent: 404 back-off; no agent: Docker's flag only.
Tests TestR528_* red first / red-proved. Commit only.

controller/cmd/controller/hostoom_wiring.go

@@ -0,0 +1,50 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net/http"
+	"sync"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/agentapi"
+)
+
+// hostOOMSource (R-528) is the 30-s dead-app scan's host-side OOM counter: one agent call per scan (5 s cap). An agent
+// without the route (404) is not asked again for hostOOMRetryAfter, and said once; any other failure is a nil answer
+// for this scan only (Docker's flag still works). Pinned by TestR528_HostOOMSource*.
+const hostOOMRetryAfter = 10 * time.Minute
+
+func hostOOMSource(ask func(context.Context) (agentapi.GuestOOMKillsState, error), logger *log.Logger, now func() time.Time) func() map[string]int64 {
+	var mu sync.Mutex
+	var until time.Time
+	said := false
+	return func() map[string]int64 {
+		mu.Lock()
+		defer mu.Unlock()
+		if now().Before(until) {
+			return nil
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		st, err := ask(ctx)
+		if err != nil {
+			var se *agentapi.StatusError
+			if errors.As(err, &se) && se.Code == http.StatusNotFound {
+				until = now().Add(hostOOMRetryAfter)
+				if !said {
+					logger.Printf("[INFO] [deadapp] the agent has no OOM counter route (R-528) — Docker's OOM flag only; asked again in %s", hostOOMRetryAfter)
+					said = true
+				}
+				return nil
+			}
+			logger.Printf("[WARN] [deadapp] the host OOM counter could not be read: %v — Docker's OOM flag only for this scan", err)
+			return nil
+		}
+		if !st.Available {
+			return nil
+		}
+		return st.Containers
+	}
+}