swarm-grafana: a host dashboard for the collector's system metrics

Adds host.json (hive and host filters over the hostmetrics series),
registers it in the provisioned dashboard list, lists it in the swarm
services handbook, and adds a module-eval case that it ships and every
query filters on both variables.

docs/2-handbook/swarm/services.md

@@ -212,6 +212,7 @@ kept.
 - `review-classifier`: review requests by outcome, the verdict mix, results per check, retried asks, and run duration p50 and p95.
 - `forge`: the forge, in three tabs. **content** has what the forge holds (repositories, users, issues, releases, discussion volume and the issues by label). **runtime** has the forge process's CPU, memory, goroutines and descriptors. **CI runs** has Actions run time and queue wait per repo and workflow, with a per-PR table; the Repo and Workflow filters apply to that tab.
 - `gateway`: the gateway nginx on each hive's host: requests per second, connections by state, and accepted against handled connections.
+- `host`: the machine under each hive, from the collector's host metrics: CPU by state, load, memory, swap and paging, disk and network throughput, filesystem usage, the Nix store's share and the busiest agent containers. Filter by hive and host.
 - `collector`: what the hive and swarm OTEL collectors accept, refuse, export and queue, with queue depth against capacity.
 - `logstore`, `metricstore`: health of the log store and the metrics store.
 - `grafana`: Grafana itself. Dashboards and data sources, alert instances firing, requests by status and their latency, alert rule evaluations and failures, sign-ins, database connections, memory and goroutines.

nix/host-modules/swarm-grafana.nix

@@ -282,6 +282,7 @@ let
         "forge.json"
         "gateway.json"
         "grafana.json"
+        "host.json"
         "logstore.json"
         "matrix.json"
         "metricstore.json"

nix/module-eval/grafana.nix

@@ -624,6 +624,23 @@ let
           ]
         ) tables;
     }
+    {
+      # The host board ships, and every query filters on both template
+      # variables: a panel missing one shows another hive's or host's numbers
+      # under this selection.
+      name = "the host dashboard ships, and every panel query filters on hive and host";
+      ok =
+        let
+          provider = lib.head grafanaWithAuthelia.containers.swarm-grafana.config.services.grafana.provision.dashboards.settings.providers;
+          shipped = lib.attrNames provider.options.path.entries;
+          board = builtins.fromJSON (builtins.readFile ../host-modules/swarm-grafana/dashboards/host.json);
+          exprs = lib.concatMap (p: map (t: t.expr) p.targets) board.panels;
+        in
+        lib.elem "host.json" shipped
+        && lib.length exprs > 0
+        && lib.all (e: lib.hasInfix "hive=~\"$hive\"" e && lib.hasInfix "\"host.name\"=~\"$host\"" e) exprs
+        && lib.any (e: lib.hasInfix "system.cpu.time" e) exprs;
+    }
     {
       # The egress board ships, and its queries read the two squid log lines as
       # squid writes them: the would_deny line's field layout, and the default