feat: health check configuration and worker engine (Phase 3+4)

- Added health_check_poller.rs: periodic service/HTTP health checks
- Added pre-patch health gate in job_executor.rs
- Added waiting_health_check job status (migration 008)
- Added health_check_status to HostSummary and hosts API
- Added health check types and API functions to frontend
- Added health check UI section to HostDetailPage
- Added health check status indicators to HostsPage and PatchDeploymentPage
- Added serde default for health_check_poll_interval_secs
- Fixed missing AgentClient import in health_check_poller.rs
- Fixed missing ws_relay import in main.rs
- Fixed missing closing paren in retry_pending_jobs SQL
- Added ReadWritePaths for /etc/patch-manager/keys in systemd services

frontend/src/pages/HostsPage.tsx

@@ -5,6 +5,7 @@ import {
   TableRow, TextField, Toolbar, Tooltip, Typography,
 } from '@mui/material'
 import { Add as AddIcon, Refresh as RefreshIcon, Delete as DeleteIcon } from '@mui/icons-material'
+import { CheckCircle as CheckCircleIcon, Cancel as CancelIcon, Remove as RemoveIcon } from '@mui/icons-material'
 import { useNavigate } from 'react-router-dom'
 import { apiClient, hostsApi } from '../api/client'
 import type { Host, HostHealthStatus } from '../types'
@@ -67,6 +68,7 @@ export default function HostsPage() {
                 <TableCell>IP Address</TableCell>
                 <TableCell>OS</TableCell>
                 <TableCell>Health</TableCell>
+                <TableCell>Checks</TableCell>
                 <TableCell>Agent</TableCell>
                 <TableCell>Actions</TableCell>
               </TableRow>
@@ -82,6 +84,15 @@ export default function HostsPage() {
                   <TableCell>
                     <Chip size="small" label={h.health_status} color={statusColor(h.health_status)} />
                   </TableCell>
+                  <TableCell>
+                    {h.health_check_status === 'all_healthy' ? (
+                      <Tooltip title="All checks healthy"><CheckCircleIcon color="success" fontSize="small" /></Tooltip>
+                    ) : h.health_check_status === 'some_unhealthy' ? (
+                      <Tooltip title="Some checks unhealthy"><CancelIcon color="error" fontSize="small" /></Tooltip>
+                    ) : (
+                      <Tooltip title="No checks configured"><RemoveIcon color="disabled" fontSize="small" /></Tooltip>
+                    )}
+                  </TableCell>
                   <TableCell>{h.agent_version ?? '—'}</TableCell>
                   <TableCell onClick={e => e.stopPropagation()}>
                     <Tooltip title="Request refresh">