Add SshHostCollector for .180 (omv) and .171 (ripper)

Extends monitoring to the two bare-metal boxes Proxmox can't see.
Uses a dedicated ed25519 key with a forced authorized_keys command
(see docs/ssh-collector-key-setup.md) so a leaked key can only ever
run the fixed read-only stats script, never arbitrary commands.

CPU is approximated from 1-min load average / core count (a true
utilization % would need two /proc/stat samples).

Closes #8.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -24,3 +24,7 @@ COOKIE_SECURE=false
 PORT=3000
 POLL_INTERVAL_SECONDS=30
 SNAPSHOT_RETENTION_HOURS=24
+
+# Dedicated key for SshHostCollector (omv, ripper) — see docs/ssh-collector-key-setup.md.
+# In docker-compose this is mounted from ./ssh/monitor_ed25519 (gitignored, not this path).
+SSH_PRIVATE_KEY_PATH=./ssh/monitor_ed25519