hub v0.27.0: Hosts page — read-only fleet view (audit F-M1)

New Hosts nav section: a fleet list (/hosts) + per-host detail (/hosts/{id}),
read-only (GET only, no host actions). Surfaces identity, agent version,
online/stale status (reusing the HostStalenessChecker threshold), guests,
vitals, storage targets with SMART/thin-pool, and DR/escrow presence.

- store: new ListGuestsForHost reader (reality cols only; omits api_key/
  desired_spec_json) + scanGuest helper.
- web: handleHostsList + handleHostDetail (hosts.go); hosts.html +
  host_detail.html; Hosts nav link on every page; timeAgoPtr helper; routes.
- tests: store getter, both handlers, no-secret (api_key) assertion, 404,
  no-report empty state, status-band mapping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/store/store.go

@@ -1620,6 +1620,50 @@ func (s *Store) UpsertGuestFromReport(g *Guest) error {
 	return err
 }
 
+// guestRealitySelectCols are the report-driven reality columns (plus identity/timestamps)
+// of a guest. It deliberately OMITS the secret/inert columns (api_key, desired_spec_json):
+// the read-only Hosts view never renders them, so they are not selected.
+const guestRealitySelectCols = `guest_id, customer_id, host_id, vmid, display_name, status,
+	controller_version, last_seen_at, created_at, updated_at`
+
+func scanGuest(scan func(dest ...any) error) (*Guest, error) {
+	var g Guest
+	var lastSeen sql.NullString
+	var createdAt, updatedAt string
+	err := scan(&g.GuestID, &g.CustomerID, &g.HostID, &g.VMID, &g.DisplayName, &g.Status,
+		&g.ControllerVersion, &lastSeen, &createdAt, &updatedAt)
+	if err != nil {
+		return nil, err
+	}
+	if lastSeen.Valid && lastSeen.String != "" {
+		t := parseSQLiteTime(lastSeen.String)
+		g.LastSeenAt = &t
+	}
+	g.CreatedAt = parseSQLiteTime(createdAt)
+	g.UpdatedAt = parseSQLiteTime(updatedAt)
+	return &g, nil
+}
+
+// ListGuestsForHost returns the guests (controller LXCs) enrolled on a host, ordered by
+// vmid. Reads only reality columns (no api_key / desired_spec_json). Returns an empty
+// slice (never nil-error) when the host has no guests — the read-only Hosts detail view.
+func (s *Store) ListGuestsForHost(hostID string) ([]Guest, error) {
+	rows, err := s.db.Query(`SELECT `+guestRealitySelectCols+` FROM guests WHERE host_id = ? ORDER BY vmid`, hostID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	guests := []Guest{}
+	for rows.Next() {
+		g, err := scanGuest(rows.Scan)
+		if err != nil {
+			return nil, err
+		}
+		guests = append(guests, *g)
+	}
+	return guests, rows.Err()
+}
+
 // GetHostStaleness returns per-host recency for the dead-man's-switch. Hosts that
 // have never reported (NULL last_report_at) are skipped — a freshly-minted host is
 // not "down" until it has checked in at least once.