feat: health check configuration and worker engine (Phase 3+4)

- Added health_check_poller.rs: periodic service/HTTP health checks
- Added pre-patch health gate in job_executor.rs
- Added waiting_health_check job status (migration 008)
- Added health_check_status to HostSummary and hosts API
- Added health check types and API functions to frontend
- Added health check UI section to HostDetailPage
- Added health check status indicators to HostsPage and PatchDeploymentPage
- Added serde default for health_check_poll_interval_secs
- Fixed missing AgentClient import in health_check_poller.rs
- Fixed missing ws_relay import in main.rs
- Fixed missing closing paren in retry_pending_jobs SQL
- Added ReadWritePaths for /etc/patch-manager/keys in systemd services

crates/pm-agent-client/src/client.rs

@@ -30,7 +30,7 @@ use crate::{
     error::AgentClientError,
     types::{
         AgentEnvelope, AgentJobStatus, ApplyPatchesRequest, ApplyPatchesResponse, HealthData,
-        PackagesData, PatchesData, RollbackResponse, SystemInfoData,
+        PackagesData, PatchesData, RollbackResponse, ServiceStatusData, SystemInfoData,
     },
 };
 
@@ -221,10 +221,17 @@ impl AgentClient {
             .await
     }
 
+    /// `GET /api/v1/system/services/{name}` — check status of a specific service on the agent.
+    #[instrument(skip(self), fields(base_url = %self.base_url, service_name = %service_name))]
+    pub async fn service_status(&self, service_name: &str) -> Result<ServiceStatusData, AgentClientError> {
+        self.get(&format!("system/services/{}", service_name), &[]).await
+    }
+
     // --------------------------------------------------------
     // Private POST helper
     // --------------------------------------------------------
 
+
     /// Execute a POST request against `{base_url}/{path}`, serialize `body` as
     /// JSON, deserialize the [`AgentEnvelope`], and extract the `data` field —
     /// or propagate an [`AgentClientError::ApiError`].