hub v0.27.0: Hosts page — read-only fleet view (audit F-M1)

New Hosts nav section: a fleet list (/hosts) + per-host detail (/hosts/{id}),
read-only (GET only, no host actions). Surfaces identity, agent version,
online/stale status (reusing the HostStalenessChecker threshold), guests,
vitals, storage targets with SMART/thin-pool, and DR/escrow presence.

- store: new ListGuestsForHost reader (reality cols only; omits api_key/
  desired_spec_json) + scanGuest helper.
- web: handleHostsList + handleHostDetail (hosts.go); hosts.html +
  host_detail.html; Hosts nav link on every page; timeAgoPtr helper; routes.
- tests: store getter, both handlers, no-secret (api_key) assertion, 404,
  no-report empty state, status-band mapping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/store/host_test.go

@@ -4,6 +4,7 @@ import (
 	"io"
 	"log"
 	"path/filepath"
+	"strconv"
 	"testing"
 )
 
@@ -144,6 +145,56 @@ func TestUpsertGuestFromReport_PreservesInertColumns(t *testing.T) {
 	}
 }
 
+func TestListGuestsForHost(t *testing.T) {
+	s := newTestStore(t)
+
+	// none → empty (never nil-error)
+	guests, err := s.ListGuestsForHost("h1")
+	if err != nil {
+		t.Fatalf("ListGuestsForHost (none): %v", err)
+	}
+	if len(guests) != 0 {
+		t.Errorf("no guests → want 0, got %d", len(guests))
+	}
+
+	// multiple, inserted out of vmid order → returned ordered by vmid
+	for _, vmid := range []int{300, 100, 200} {
+		g := &Guest{GuestID: GuestID("h1", vmid), CustomerID: "c1", HostID: "h1", VMID: vmid,
+			DisplayName: "g" + strconv.Itoa(vmid), Status: "running", ControllerVersion: "0.87.0"}
+		if err := s.UpsertGuestFromReport(g); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// a guest on a different host must not leak in
+	if err := s.UpsertGuestFromReport(&Guest{GuestID: GuestID("h2", 999), CustomerID: "c2", HostID: "h2", VMID: 999}); err != nil {
+		t.Fatal(err)
+	}
+	// set a secret column to prove the reader never surfaces it
+	if _, err := s.db.Exec(`UPDATE guests SET api_key='SECRET' WHERE host_id='h1'`); err != nil {
+		t.Fatal(err)
+	}
+
+	guests, err = s.ListGuestsForHost("h1")
+	if err != nil {
+		t.Fatalf("ListGuestsForHost (multi): %v", err)
+	}
+	if len(guests) != 3 {
+		t.Fatalf("want 3 guests for h1, got %d", len(guests))
+	}
+	wantOrder := []int{100, 200, 300}
+	for i, g := range guests {
+		if g.VMID != wantOrder[i] {
+			t.Errorf("guest[%d].VMID = %d, want %d (vmid order)", i, g.VMID, wantOrder[i])
+		}
+		if g.ControllerVersion != "0.87.0" || g.Status != "running" {
+			t.Errorf("guest[%d] reality wrong: %+v", i, g)
+		}
+		if g.APIKey != "" {
+			t.Errorf("guest[%d] APIKey must not be read, got %q", i, g.APIKey)
+		}
+	}
+}
+
 func TestGetHostStaleness_SkipsNeverReported(t *testing.T) {
 	s := newTestStore(t)
 	s.UpsertHost(&Host{HostID: "h1", CustomerID: "c1", APIKey: "k1"})

hub/internal/store/store.go

@@ -1620,6 +1620,50 @@ func (s *Store) UpsertGuestFromReport(g *Guest) error {
 	return err
 }
 
+// guestRealitySelectCols are the report-driven reality columns (plus identity/timestamps)
+// of a guest. It deliberately OMITS the secret/inert columns (api_key, desired_spec_json):
+// the read-only Hosts view never renders them, so they are not selected.
+const guestRealitySelectCols = `guest_id, customer_id, host_id, vmid, display_name, status,
+	controller_version, last_seen_at, created_at, updated_at`
+
+func scanGuest(scan func(dest ...any) error) (*Guest, error) {
+	var g Guest
+	var lastSeen sql.NullString
+	var createdAt, updatedAt string
+	err := scan(&g.GuestID, &g.CustomerID, &g.HostID, &g.VMID, &g.DisplayName, &g.Status,
+		&g.ControllerVersion, &lastSeen, &createdAt, &updatedAt)
+	if err != nil {
+		return nil, err
+	}
+	if lastSeen.Valid && lastSeen.String != "" {
+		t := parseSQLiteTime(lastSeen.String)
+		g.LastSeenAt = &t
+	}
+	g.CreatedAt = parseSQLiteTime(createdAt)
+	g.UpdatedAt = parseSQLiteTime(updatedAt)
+	return &g, nil
+}
+
+// ListGuestsForHost returns the guests (controller LXCs) enrolled on a host, ordered by
+// vmid. Reads only reality columns (no api_key / desired_spec_json). Returns an empty
+// slice (never nil-error) when the host has no guests — the read-only Hosts detail view.
+func (s *Store) ListGuestsForHost(hostID string) ([]Guest, error) {
+	rows, err := s.db.Query(`SELECT `+guestRealitySelectCols+` FROM guests WHERE host_id = ? ORDER BY vmid`, hostID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	guests := []Guest{}
+	for rows.Next() {
+		g, err := scanGuest(rows.Scan)
+		if err != nil {
+			return nil, err
+		}
+		guests = append(guests, *g)
+	}
+	return guests, rows.Err()
+}
+
 // GetHostStaleness returns per-host recency for the dead-man's-switch. Hosts that
 // have never reported (NULL last_report_at) are skipped — a freshly-minted host is
 // not "down" until it has checked in at least once.