feat: health check configuration and worker engine (Phase 3+4)

- Added health_check_poller.rs: periodic service/HTTP health checks
- Added pre-patch health gate in job_executor.rs
- Added waiting_health_check job status (migration 008)
- Added health_check_status to HostSummary and hosts API
- Added health check types and API functions to frontend
- Added health check UI section to HostDetailPage
- Added health check status indicators to HostsPage and PatchDeploymentPage
- Added serde default for health_check_poll_interval_secs
- Fixed missing AgentClient import in health_check_poller.rs
- Fixed missing ws_relay import in main.rs
- Fixed missing closing paren in retry_pending_jobs SQL
- Added ReadWritePaths for /etc/patch-manager/keys in systemd services

frontend/src/api/client.ts

@@ -7,6 +7,9 @@ import type {
   UpdateMaintenanceWindowRequest,
   Certificate,
   IssuedCert,
+  HealthCheckWithResult,
+  CreateHealthCheckRequest,
+  UpdateHealthCheckRequest,
 } from '../types'
 
 const BASE_URL = '/api/v1'
@@ -259,3 +262,25 @@ export const settingsApi = {
   updateIpWhitelist: (entries: string[]) => apiClient.put<{ entries: string[] }>('/settings/ip-whitelist', { entries }),
   auditIntegrity: () => apiClient.post<AuditIntegrityResult>('/settings/audit-integrity'),
 }
+
+// ── Health Checks API ─────────────────────────────────────────────────────────
+
+export const healthChecksApi = {
+  list: (hostId: string) =>
+    apiClient.get<HealthCheckWithResult[]>(`/hosts/${hostId}/health-checks`),
+
+  get: (hostId: string, checkId: string) =>
+    apiClient.get<HealthCheckWithResult>(`/hosts/${hostId}/health-checks/${checkId}`),
+
+  create: (hostId: string, body: CreateHealthCheckRequest) =>
+    apiClient.post<HealthCheckWithResult>(`/hosts/${hostId}/health-checks`, body),
+
+  update: (hostId: string, checkId: string, body: UpdateHealthCheckRequest) =>
+    apiClient.put<HealthCheckWithResult>(`/hosts/${hostId}/health-checks/${checkId}`, body),
+
+  delete: (hostId: string, checkId: string) =>
+    apiClient.delete(`/hosts/${hostId}/health-checks/${checkId}`),
+
+  test: (hostId: string, checkId: string) =>
+    apiClient.post<HealthCheckWithResult>(`/hosts/${hostId}/health-checks/${checkId}/test`),
+}