feat: machine metrics (CPU, memory, network) on the status page

The status page answered "are the components running" but said nothing
about the machine underneath them, so a server slowed to a crawl by a
busy processor or one about to have Postfix OOM-killed looked entirely
healthy until the queue backed up.

internal/health/machine.go reads the kernel's counters in /proc: the
aggregate processor times and core count from /proc/stat, the load
average from /proc/loadavg, memory and swap from /proc/meminfo, and
per-interface byte counters from /proc/net/dev.

CPU busy time and network throughput are rates, so a MachineSampler holds
the previous reading and each call reports the difference — one shared
sampler on the Server, since a per-request one would never have anything
to subtract. A window longer than a minute only re-baselines: a page
opened after the panel sat idle would otherwise average that whole
stretch and present it as the current load.

Memory is derived from MemAvailable rather than MemFree, because Linux
spends every spare page on cache and MemFree would report a permanent
emergency. A fully busy processor (>=90%) warns and an exhausted machine
(>=97%) errors, both counting towards the page's headline verdict, since
either delays or kills the mail path. Throughput has no comparable
threshold — what counts as a lot depends on the link — so it is reported
and never graded. Loopback is excluded: that traffic is the container
talking to itself.

Like every other check here, an unreadable counter degrades to "unknown"
with an explanation instead of failing the page, so the panel still runs
outside Linux for development.

The usage bars are <meter> elements. The panel's CSP has no inline-style
exemption, so a bar's length has to travel on an attribute; the element
also grades its own colour from low/high/optimum, and the percentage is
printed beside it for anything that does not render meters.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,23 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Added
+
+- Machine metrics on the status page: a **Machine** card reporting the
+  processor (busy percentage, core count, load average), memory and swap, and
+  network throughput and totals per interface, read from the kernel's counters
+  in `/proc` (`internal/health/machine.go`). CPU and throughput are differences
+  between two readings, so they are measured against the previous poll of the
+  status fragment and reported as still being measured until a second reading
+  exists — a page opened after a long idle stretch re-baselines rather than
+  presenting that stretch as the current load. A fully busy processor (≥90%)
+  warns and an exhausted machine (≥97% of memory in use) errors, both counting
+  towards the page's headline verdict, since either delays or kills the mail
+  path; throughput is reported and never graded. Counters that cannot be read
+  — no `/proc` outside Linux — leave the card in place showing "unknown". The
+  usage bars are `<meter>` elements: the panel's CSP has no inline-style
+  exemption, so a bar's length has to travel on an attribute.
+
 ## [0.5.0] - 2026-08-06
 
 ### Fixed