hub v0.27.0: Hosts page — read-only fleet view (audit F-M1)

New Hosts nav section: a fleet list (/hosts) + per-host detail (/hosts/{id}),
read-only (GET only, no host actions). Surfaces identity, agent version,
online/stale status (reusing the HostStalenessChecker threshold), guests,
vitals, storage targets with SMART/thin-pool, and DR/escrow presence.

- store: new ListGuestsForHost reader (reality cols only; omits api_key/
  desired_spec_json) + scanGuest helper.
- web: handleHostsList + handleHostDetail (hosts.go); hosts.html +
  host_detail.html; Hosts nav link on every page; timeAgoPtr helper; routes.
- tests: store getter, both handlers, no-secret (api_key) assertion, 404,
  no-report empty state, status-band mapping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/web/server.go

@@ -47,7 +47,13 @@ type Server struct {
 // New creates a new web server.
 func New(store *store.Store, passwordHash, apiKey, version string, staleThreshold time.Duration, logger *log.Logger) *Server {
 	funcMap := template.FuncMap{
-		"timeAgo":     timeAgo,
+		"timeAgo": timeAgo,
+		"timeAgoPtr": func(t *time.Time) string {
+			if t == nil {
+				return "—"
+			}
+			return timeAgo(*t)
+		},
 		"statusColor": statusColor,
 		"statusIcon":  statusIcon,
 		"formatFloat": func(f float64) string { return fmt.Sprintf("%.0f", f) },
@@ -171,6 +177,12 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	case strings.HasPrefix(path, "/apps/"):
 		appName := strings.TrimPrefix(path, "/apps/")
 		s.handleAppDetail(w, r, appName)
+	// Hosts — read-only fleet view (audit F-M1). GET only; no host actions.
+	case path == "/hosts" || path == "/hosts/":
+		s.handleHostsList(w, r)
+	case strings.HasPrefix(path, "/hosts/"):
+		hostID := strings.TrimPrefix(path, "/hosts/")
+		s.handleHostDetail(w, r, hostID)
 	case path == "/login":
 		s.handleLogin(w, r)
 	case strings.HasPrefix(path, "/customers/") && strings.HasSuffix(path, "/block"):