fix: CIDR suffix in agent URLs, agent client CIDR strip, and IP SAN fixes

BUG-10: PostgreSQL inet type includes CIDR suffix (/32) when cast to text,
causing malformed agent URLs like https://127.0.0.1/32:12443.
Fixed by using host(ip_address)::text in all SQL queries across
pm-worker and pm-web modules, and adding a Rust-side safety
strip of CIDR notation in pm-agent-client.

Files changed:
- crates/pm-agent-client/src/client.rs: strip CIDR suffix from IP
- crates/pm-worker/src/health_poller.rs: host(ip_address)::text
- crates/pm-worker/src/patch_poller.rs: host(ip_address)::text
- crates/pm-worker/src/refresh_listener.rs: host(ip_address)::text
- crates/pm-worker/src/job_executor.rs: host(ip_address)::text (2 places)
- crates/pm-worker/src/ws_relay.rs: host(h.ip_address)::text
- crates/pm-web/src/routes/discovery.rs: host(ip_address)::text (2 places)
- crates/pm-web/src/routes/hosts.rs: host(ip_address)::text (3 places)
- docs/linux_patch_api_research.md: added research notes

crates/pm-web/src/routes/discovery.rs

@@ -194,7 +194,7 @@ async fn get_scan_results(
     Path(scan_id): Path<Uuid>,
 ) -> Result<Json<Vec<DiscoveryResult>>, (StatusCode, Json<Value>)> {
     sqlx::query_as::<_, DiscoveryResult>(
-        r#"SELECT id, scan_id, ip_address::text AS ip_address, fqdn,
+        r#"SELECT id, scan_id, host(ip_address)::text AS ip_address, fqdn,
                   agent_version, os_name, agent_port, discovered_at, registered
            FROM discovery_results
            WHERE scan_id = $1
@@ -230,7 +230,7 @@ async fn register_discovered_host(
 
     // Fetch discovery result
     let result: Option<DiscoveryResult> = sqlx::query_as(
-        r#"SELECT id, scan_id, ip_address::text AS ip_address, fqdn,
+        r#"SELECT id, scan_id, host(ip_address)::text AS ip_address, fqdn,
                   agent_version, os_name, agent_port, discovered_at, registered
            FROM discovery_results WHERE id = $1"#,
     )