Add a stats agent container: FastAPI + psutil behind an API key

Exposes host CPU, memory, disk, and network usage over HTTP for the
dashboard's System Stats block (or anything else that can send a header)
to poll. Auth is a required X-API-Key, auto-generated and persisted on
first run if not supplied, checked with a constant-time comparison and
rate-limited after repeated failures. No CORS, so a browser can't call it
directly from another origin -- only a server-side caller can, keeping
the key out of anyone's network tab.

docker-compose.yml

@@ -0,0 +1,27 @@
+services:
+  agent:
+    build: .
+    container_name: vps-dash-agent
+    # Avoids compose creating a dedicated per-project network — on a host
+    # that's accumulated enough docker networks over time, Docker's
+    # auto-allocated subnet pool can run out ("all predefined address pools
+    # have been fully subnetted"). This is a single-service stack with
+    # nothing to reach it by container DNS name, so there's nothing lost by
+    # reusing the always-present default bridge network instead.
+    network_mode: bridge
+    restart: unless-stopped
+    ports:
+      - '9090:9090'
+    environment:
+      # Leave unset to auto-generate a key on first run (see the container
+      # logs, and data/api_key.txt on the volume below) instead of picking
+      # your own.
+      - API_KEY=${API_KEY:-}
+    volumes:
+      - agent-data:/data
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/host/root:ro
+
+volumes:
+  agent-data: