feat: grouped server cards with progress bars and sparklines

- Agent sends group name (defaults to hostname) and richer metric notes
  (memory/disk include absolute GB values; CPU note includes system uptime)
- push() accepts group param; server stores it as agent_group on deployments
- Upsert key is now (company_id, agent_group, name) so two agents on the
  same company but different servers don't overwrite each other's CPU/Memory
- Add widget config packs: linux-base, web-nginx, database-postgres/redis,
  docker-host, custom-cmd examples

widgets/custom-cmd.yml

@@ -0,0 +1,33 @@
+# Custom command examples.
+# Exit code convention: 0 = online, 1 = degraded, anything else = offline.
+
+widgets:
+  # Health endpoint that returns HTTP 200
+  - type: custom_cmd
+    name: App health
+    cmd: curl -sf https://myapp.example.com/health > /dev/null && exit 0 || exit 2
+
+  # Disk space on a non-root mount
+  - type: custom_cmd
+    name: Disk /backup
+    cmd: |
+      PCT=$(df /backup | awk 'NR==2{gsub(/%/,"",$5); print $5}')
+      [ "$PCT" -gt 90 ] && exit 2
+      [ "$PCT" -gt 80 ] && exit 1 || exit 0
+
+  # SSL certificate expiry (degraded < 14 days, offline < 3 days)
+  - type: custom_cmd
+    name: SSL expiry
+    cmd: |
+      DAYS=$(echo | openssl s_client -connect myapp.example.com:443 2>/dev/null \
+        | openssl x509 -noout -enddate 2>/dev/null \
+        | sed 's/notAfter=//' \
+        | xargs -I{} python3 -c "import datetime; e=datetime.datetime.strptime('{}','%b %d %H:%M:%S %Y %Z'); print((e-datetime.datetime.utcnow()).days)" 2>/dev/null)
+      [ -z "$DAYS" ] && exit 2
+      [ "$DAYS" -lt 3 ] && exit 2
+      [ "$DAYS" -lt 14 ] && exit 1 || exit 0
+
+  # Systemd service check
+  - type: custom_cmd
+    name: my-service.service
+    cmd: systemctl is-active --quiet my-service && exit 0 || exit 2

widgets/database-postgres.yml

@@ -0,0 +1,21 @@
+# PostgreSQL — process check + port + optional replication lag custom check.
+
+widgets:
+  - type: process_check
+    name: PostgreSQL
+    process: postgres
+
+  - type: port_check
+    name: PG Port
+    host: localhost
+    port: 5432
+    timeout: 5
+
+  # Optional: check replication lag (requires psql access).
+  # Exit 0 = ok, exit 1 = lag > threshold, exit 2 = cannot connect.
+  # - type: custom_cmd
+  #   name: PG Replication lag
+  #   cmd: |
+  #     LAG=$(psql -U postgres -tAc "SELECT EXTRACT(EPOCH FROM (now() - pg_last_xact_replay_timestamp()))::int" 2>/dev/null)
+  #     [ -z "$LAG" ] && exit 2
+  #     [ "$LAG" -gt 300 ] && exit 1 || exit 0

widgets/database-redis.yml

@@ -0,0 +1,17 @@
+# Redis — process check + port + optional ping.
+
+widgets:
+  - type: process_check
+    name: Redis
+    process: redis-server
+
+  - type: port_check
+    name: Redis Port
+    host: localhost
+    port: 6379
+    timeout: 3
+
+  # Optional: PING check (requires redis-cli).
+  # - type: custom_cmd
+  #   name: Redis PING
+  #   cmd: redis-cli ping | grep -q PONG && exit 0 || exit 2

widgets/docker-host.yml

@@ -0,0 +1,20 @@
+# Docker host — disk for docker data dir + Docker daemon check.
+
+widgets:
+  - type: system_disk
+    name: Docker disk
+    path: /var/lib/docker
+    degrade_threshold: 75
+    offline_threshold: 90
+
+  - type: custom_cmd
+    name: Docker daemon
+    cmd: docker info > /dev/null 2>&1 && exit 0 || exit 2
+
+  # Optional: count running containers (degraded if 0, offline if docker is down).
+  # - type: custom_cmd
+  #   name: Containers running
+  #   cmd: |
+  #     COUNT=$(docker ps -q 2>/dev/null | wc -l)
+  #     [ $? -ne 0 ] && exit 2
+  #     [ "$COUNT" -eq 0 ] && exit 1 || exit 0

widgets/linux-base.yml

@@ -0,0 +1,19 @@
+# Linux base — CPU, memory and disk.
+# Paste into your ethica-agent.yml widgets section.
+
+widgets:
+  - type: system_cpu
+    name: CPU
+    degrade_threshold: 80
+    offline_threshold: 95
+
+  - type: system_memory
+    name: Memory
+    degrade_threshold: 85
+    offline_threshold: 97
+
+  - type: system_disk
+    name: Disk /
+    path: /
+    degrade_threshold: 80
+    offline_threshold: 95

widgets/web-nginx.yml

@@ -0,0 +1,22 @@
+# Nginx web server — process check + HTTP/HTTPS endpoint + ports.
+# Replace MY_DOMAIN with the actual domain.
+
+widgets:
+  - type: process_check
+    name: nginx
+    process: nginx
+
+  - type: http_check
+    name: HTTPS
+    url: https://MY_DOMAIN
+    timeout: 10
+
+  - type: port_check
+    name: Port 80
+    host: localhost
+    port: 80
+
+  - type: port_check
+    name: Port 443
+    host: localhost
+    port: 443