[Backend] Custom host vitals (schema + CRUD)

[nulmete]

Related user story

#44954

Task

Provide the server-side foundation for custom host vitals: globally-defined, per-host key/value fields that surface on the Host details page.

Condition of satisfaction

• Migrations create custom_host_vitals + host_custom_host_vitals.
• CRUD endpoints + host-value setter work with correct auth; duplicate name → 409/422; delete of a referenced vital → in-use error.
• $FLEET_HOST_VITAL_<id> validates on script/profile upload (missing id rejected) and expands per-host in Apple profiles, Windows profiles, DDM, and scripts. Note: if a vital is referenced but has no value we should error out.
• Deleting a vital clears its per-host values (cascade) but is blocked while referenced in content.
• Activities emitted + documented; permissions enforced (incl. .rego tests).

Open questions (as of 1-Jul-2026):

1. Reports → value ingestion: does a vital's per-host value auto-populate from a report's query_results (snapshot, discard_data=0; ingest hook near saveResultLogsToQueryReports, server/service/osquery.go:3121 → OverwriteQueryResultRows)? If so, how does a vital bind to a report + column (new columns on custom_host_vitals), and what's the single-value rule when a query returns 0 / 1 / >1 rows? Or is v1 manual-set only? the wording is a little ambiguous and the mention of reports confuses things; I think it's basically meant as "so that I can store information from external sources" (as opposed to info gathered via reports)
2. Value uniqueness across hosts: should we allow the same value for a custom host vital in two different hosts? Yes
3. Host-value endpoint shape (PR #44954 API design: Custom host vitals #48369 TODO): confirm path/body.