v0.1.0

Added

• Agentless collection over SSH with one persistent session per host and a
  single read-only POSIX shell script per tick, tested on Debian, Ubuntu,
  Rocky, Fedora, openSUSE and Alpine.
• Local mode (serve --local) that monitors the machine it runs on.
• Fleet overview with groups, tags, search, sparklines and distinct states
  for unreachable hosts, authentication failures, host key problems and
  partial collections.
• Host detail with live and historical charts, per-core CPU heatmap, top
  processes, listening ports, services, containers and system information.
• History in SQLite with 1-minute and 5-minute rollups and configurable
  retention.
• Inventory snapshots, change timeline and host-to-host or baseline
  comparison.
• Security overview: failed SSH logins, pending and security updates,
  reboot-required flags, ports not on the baseline and TLS certificate
  expiry.
• Alert rules with durations and scopes, built-in rules, acknowledgements,
  silences, reminders, and webhook, Slack and email notifications.
• Opt-in actions with confirmation and a hash-chained, append-only audit log.
• Viewer, operator and admin roles; Argon2id passwords; TOTP; OpenID Connect
  single sign-on with role mapping.
• Wall display mode with revocable, group-scoped display tokens.
• Versioned JSON API with OpenAPI document, server-sent events and a
  Prometheus endpoint.
• TLS with provided certificates or a generated self-signed certificate.
• Secrets encrypted at rest with XChaCha20-Poly1305.
• CLI: serve, init, user, hosts test, config check, secret,
  audit verify.