feat: add Node Exporter and cAdvisor monitoring agents

[mcansem]

Summary

• Add docker/monitoring-agent/docker-compose.yml: Node Exporter (host metrics) and cAdvisor (per-container metrics), deployed identically on every host role
• Both bind to 127.0.0.1 only by default - neither has any authentication, so publishing to all interfaces would leak metrics to anyone who can reach the port
• Cross-host Prometheus scraping (needed once app/agent hosts have real IPs) is a documented two-step manual opt-in - rebind the port, then add a UFW rule scoped to Prometheus's specific IP - not scripted blind
• No compose-level healthcheck for cadvisor: its base image's shell/wget availability isn't reliably confirmed across versions, so this defers to the image's own built-in HEALTHCHECK (if any) rather than risk a command that silently never succeeds
• cadvisor image reference corrected to ghcr.io/google/cadvisor (current registry as of v0.53.0+, not the older gcr.io/cadvisor path)
• scripts/harden-host.sh's role_ports() documents why these ports are intentionally not in the default UFW allowlist

Roadmap Phase

v0.7.0 - Observability (PR A: instrument every host. PR B will add Prometheus/Alertmanager/Grafana/Uptime Kuma and the management-proxy nginx refactor. One v0.7.0 tag after both merge.)

Environment Impact

• CI
• Staging
• Production
• No environment impact yet (nothing deployed to a live host by this PR)

Rollback Plan

Revert the merge commit; no live host runs this stack yet, so rollback has no runtime impact. Nothing in this PR touches an existing service - it's purely additive.

Checklist

• Commit messages follow Conventional Commits
• CHANGELOG.md updated (under [Unreleased])
• Scripts pass shellcheck (scripts/harden-host.sh re-verified after the comment addition)
• Docs updated (docker/monitoring-agent/README.md, docs/roadmap.md)

Test plan

• docker compose -f docker/monitoring-agent/docker-compose.yml config validates
• Deploy on a real host: confirm node-exporter/cadvisor are reachable at http://localhost:9100/metrics and http://localhost:8080/metrics from the host itself
• Confirm neither port is reachable from another machine (curl should fail/time out) until the documented opt-in is deliberately performed