feat: grouped server cards with progress bars and sparklines

- Agent sends group name (defaults to hostname) and richer metric notes
  (memory/disk include absolute GB values; CPU note includes system uptime)
- push() accepts group param; server stores it as agent_group on deployments
- Upsert key is now (company_id, agent_group, name) so two agents on the
  same company but different servers don't overwrite each other's CPU/Memory
- Add widget config packs: linux-base, web-nginx, database-postgres/redis,
  docker-host, custom-cmd examples

widgets/custom-cmd.yml

@@ -0,0 +1,33 @@
+# Custom command examples.
+# Exit code convention: 0 = online, 1 = degraded, anything else = offline.
+
+widgets:
+  # Health endpoint that returns HTTP 200
+  - type: custom_cmd
+    name: App health
+    cmd: curl -sf https://myapp.example.com/health > /dev/null && exit 0 || exit 2
+
+  # Disk space on a non-root mount
+  - type: custom_cmd
+    name: Disk /backup
+    cmd: |
+      PCT=$(df /backup | awk 'NR==2{gsub(/%/,"",$5); print $5}')
+      [ "$PCT" -gt 90 ] && exit 2
+      [ "$PCT" -gt 80 ] && exit 1 || exit 0
+
+  # SSL certificate expiry (degraded < 14 days, offline < 3 days)
+  - type: custom_cmd
+    name: SSL expiry
+    cmd: |
+      DAYS=$(echo | openssl s_client -connect myapp.example.com:443 2>/dev/null \
+        | openssl x509 -noout -enddate 2>/dev/null \
+        | sed 's/notAfter=//' \
+        | xargs -I{} python3 -c "import datetime; e=datetime.datetime.strptime('{}','%b %d %H:%M:%S %Y %Z'); print((e-datetime.datetime.utcnow()).days)" 2>/dev/null)
+      [ -z "$DAYS" ] && exit 2
+      [ "$DAYS" -lt 3 ] && exit 2
+      [ "$DAYS" -lt 14 ] && exit 1 || exit 0
+
+  # Systemd service check
+  - type: custom_cmd
+    name: my-service.service
+    cmd: systemctl is-active --quiet my-service && exit 0 || exit 2