Add a stats agent container: FastAPI + psutil behind an API key

Exposes host CPU, memory, disk, and network usage over HTTP for the
dashboard's System Stats block (or anything else that can send a header)
to poll. Auth is a required X-API-Key, auto-generated and persisted on
first run if not supplied, checked with a constant-time comparison and
rate-limited after repeated failures. No CORS, so a browser can't call it
directly from another origin -- only a server-side caller can, keeping
the key out of anyone's network tab.

app/main.py

@@ -0,0 +1,27 @@
+from contextlib import asynccontextmanager
+
+from fastapi import Depends, FastAPI
+
+from . import stats
+from .security import require_api_key
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    # Nothing to set up — importing .security already loaded/generated the
+    # API key, and stats.collect() is stateless — but FastAPI's lifespan is
+    # the natural place a future migration/warmup step would go.
+    yield
+
+
+app = FastAPI(title="VPS Dashboard Stats Agent", version="1.0.0", lifespan=lifespan)
+
+
+@app.get("/api/health")
+def health():
+    return {"status": "ok"}
+
+
+@app.get("/api/stats", dependencies=[Depends(require_api_key)])
+def get_stats():
+    return stats.collect()