feat(stats): per-container cpu/mem load (#1424 p3)

C0NT41N3R L04D on the SYST3M tab + GET /api/container-resources.

Backend (hive-c0re/src/container_stats.rs): reads cgroup v2 cpu.stat +
memory.{current,peak,max} for each running agent machine
(machine-h\x2d<name>.scope under machine.slice), read-only/world-
readable so no hive-priv. CPU is a two-sample (~200ms) host-normalised
percentage; one shared sleep covers all agents. Skips agents whose
scope dir is absent (= not running). Network omitted: agents share the
host netns, no per-container counter.

Frontend: a polled C0NT41N3R L04D table on SYST3M (agent / cpu / mem /
peak / limit with meter bars), reusing the ST4TS table style. Polls
/api/container-resources every 5s only while the tab is active.

Backend reviewed-in-principle by damocles (path escaping + cpu delta
math); ping for the on-host sign-off.

frontend/packages/dashboard/src/dashboard.css

@@ -1609,3 +1609,29 @@ body.dashboard-shell.has-selection { padding-bottom: 4.5em; }
   color: var(--muted);
   font-variant-numeric: tabular-nums;
 }
+
+/* ─── SYST3M › C0NT41N3R L04D: live cgroup cpu/mem ─────────────────────────────
+   Reuses the `.hive-stats-table` styling from the ST4TS tab; only the
+   inline meter bar is new. */
+.cload-meter {
+  display: inline-block;
+  width: 6em;
+  height: 10px;
+  vertical-align: middle;
+  margin-left: 6px;
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  overflow: hidden;
+}
+.cload-meter .fill {
+  display: block;
+  height: 100%;
+  background: var(--green);
+}
+.cload-meter .fill.warn {
+  background: var(--amber);
+}
+.cload-meter .fill.hot {
+  background: var(--red);
+}