hub v0.27.0: Hosts page — read-only fleet view (audit F-M1)

New Hosts nav section: a fleet list (/hosts) + per-host detail (/hosts/{id}),
read-only (GET only, no host actions). Surfaces identity, agent version,
online/stale status (reusing the HostStalenessChecker threshold), guests,
vitals, storage targets with SMART/thin-pool, and DR/escrow presence.

- store: new ListGuestsForHost reader (reality cols only; omits api_key/
  desired_spec_json) + scanGuest helper.
- web: handleHostsList + handleHostDetail (hosts.go); hosts.html +
  host_detail.html; Hosts nav link on every page; timeAgoPtr helper; routes.
- tests: store getter, both handlers, no-secret (api_key) assertion, 404,
  no-report empty state, status-band mapping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/store/host_test.go

@@ -4,6 +4,7 @@ import (
 	"io"
 	"log"
 	"path/filepath"
+	"strconv"
 	"testing"
 )
 
@@ -144,6 +145,56 @@ func TestUpsertGuestFromReport_PreservesInertColumns(t *testing.T) {
 	}
 }
 
+func TestListGuestsForHost(t *testing.T) {
+	s := newTestStore(t)
+
+	// none → empty (never nil-error)
+	guests, err := s.ListGuestsForHost("h1")
+	if err != nil {
+		t.Fatalf("ListGuestsForHost (none): %v", err)
+	}
+	if len(guests) != 0 {
+		t.Errorf("no guests → want 0, got %d", len(guests))
+	}
+
+	// multiple, inserted out of vmid order → returned ordered by vmid
+	for _, vmid := range []int{300, 100, 200} {
+		g := &Guest{GuestID: GuestID("h1", vmid), CustomerID: "c1", HostID: "h1", VMID: vmid,
+			DisplayName: "g" + strconv.Itoa(vmid), Status: "running", ControllerVersion: "0.87.0"}
+		if err := s.UpsertGuestFromReport(g); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// a guest on a different host must not leak in
+	if err := s.UpsertGuestFromReport(&Guest{GuestID: GuestID("h2", 999), CustomerID: "c2", HostID: "h2", VMID: 999}); err != nil {
+		t.Fatal(err)
+	}
+	// set a secret column to prove the reader never surfaces it
+	if _, err := s.db.Exec(`UPDATE guests SET api_key='SECRET' WHERE host_id='h1'`); err != nil {
+		t.Fatal(err)
+	}
+
+	guests, err = s.ListGuestsForHost("h1")
+	if err != nil {
+		t.Fatalf("ListGuestsForHost (multi): %v", err)
+	}
+	if len(guests) != 3 {
+		t.Fatalf("want 3 guests for h1, got %d", len(guests))
+	}
+	wantOrder := []int{100, 200, 300}
+	for i, g := range guests {
+		if g.VMID != wantOrder[i] {
+			t.Errorf("guest[%d].VMID = %d, want %d (vmid order)", i, g.VMID, wantOrder[i])
+		}
+		if g.ControllerVersion != "0.87.0" || g.Status != "running" {
+			t.Errorf("guest[%d] reality wrong: %+v", i, g)
+		}
+		if g.APIKey != "" {
+			t.Errorf("guest[%d] APIKey must not be read, got %q", i, g.APIKey)
+		}
+	}
+}
+
 func TestGetHostStaleness_SkipsNeverReported(t *testing.T) {
 	s := newTestStore(t)
 	s.UpsertHost(&Host{HostID: "h1", CustomerID: "c1", APIKey: "k1"})