feat: machine status page, speed test, live presence, forwards without ufw (0.0.5)

Status page per machine: CPU load, RAM and disk of the client, sampled
by the agent only while the page is open and visible (one reading
serves every open tab), plus a button that has the agent measure its
link to the host: ping, down and up.

Online/offline now comes from the control polls the hub holds open, so
a dropped agent shows offline at once instead of 45 s later, and the
dashboard keeps the status column live.

A forward rule can be created "without ufw": the panel opens nothing in
ufw for it and so revokes nothing when it is deleted. The checkbox is
shown only while the ufw integration is on.

Dashboard row actions are icons; a status action is added.

internal/proto/proto.go

@@ -89,6 +89,8 @@ const (
 	TaskSysUpdate  = "sys.update"  // download the latest agent binary and restart
 	TaskSysUsers   = "sys.users"   // report the agent's user and the login-capable users
 	TaskSysUserAdd = "sys.useradd" // create a new OS user
+	TaskSysStat    = "sys.stat"    // CPU load, RAM and disk usage right now
+	TaskSysSpeed   = "sys.speed"   // measure the link to the server (ping, down, up)
 )
 
 // FSReadCap bounds how many bytes TaskFSRead returns (5 MiB). The panel lets a
@@ -166,3 +168,21 @@ type SysUserAddArgs struct {
 	Password string `json:"password,omitempty"` // empty leaves the account without a password
 	Sudo     bool   `json:"sudo"`               // add to the sudo/wheel group
 }
+
+// SysStatResult is returned for TaskSysStat. Sizes are in bytes.
+type SysStatResult struct {
+	CPU       float64 `json:"cpu"` // load across all cores, 0..100
+	NCPU      int     `json:"ncpu"`
+	MemTotal  uint64  `json:"mem_total"`
+	MemUsed   uint64  `json:"mem_used"`
+	DiskTotal uint64  `json:"disk_total"` // filesystem holding "/"
+	DiskFree  uint64  `json:"disk_free"`
+}
+
+// SysSpeedResult is returned for TaskSysSpeed: the agent's HTTP link to the
+// server as the agent measured it. Down is server -> agent.
+type SysSpeedResult struct {
+	PingMs  float64 `json:"ping_ms"`
+	DownBps float64 `json:"down_bps"` // bits per second
+	UpBps   float64 `json:"up_bps"`
+}