feat(stats): per-container cpu/mem load (#1424 p3)

C0NT41N3R L04D on the SYST3M tab + GET /api/container-resources.

Backend (hive-c0re/src/container_stats.rs): reads cgroup v2 cpu.stat +
memory.{current,peak,max} for each running agent machine
(machine-h\x2d<name>.scope under machine.slice), read-only/world-
readable so no hive-priv. CPU is a two-sample (~200ms) host-normalised
percentage; one shared sleep covers all agents. Skips agents whose
scope dir is absent (= not running). Network omitted: agents share the
host netns, no per-container counter.

Frontend: a polled C0NT41N3R L04D table on SYST3M (agent / cpu / mem /
peak / limit with meter bars), reusing the ST4TS table style. Polls
/api/container-resources every 5s only while the tab is active.

Backend reviewed-in-principle by damocles (path escaping + cpu delta
math); ping for the on-host sign-off.

hive-c0re/src/dashboard.rs

@@ -68,6 +68,7 @@ pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
         .route("/api/state-file", get(get_state_file))
         .route("/api/reminders", get(api_reminders))
         .route("/api/stats-hive", get(api_stats_hive))
+        .route("/api/container-resources", get(api_container_resources))
         .route("/api/build-logs", get(get_build_logs_all))
         .route("/api/build-logs/{agent}", get(get_build_logs_agent))
         .route("/api/build-logs/id/{id}", get(get_build_log_full))
@@ -1748,6 +1749,12 @@ async fn api_stats_hive(axum::extract::Query(q): axum::extract::Query<StatsHiveQ
     axum::Json(crate::hive_stats::hive_snapshot(window)).into_response()
 }
 
+/// Live per-agent-container CPU + memory load from cgroup v2. Samples
+/// CPU over a short interval (~200 ms), so this call briefly awaits.
+async fn api_container_resources() -> Response {
+    axum::Json(crate::container_stats::gather().await).into_response()
+}
+
 #[derive(Deserialize)]
 struct BuildLogsQuery {
     /// Maximum number of rows to return. Capped server-side at 50