feat: machine metrics (CPU, memory, network) on the status page

The status page answered "are the components running" but said nothing
about the machine underneath them, so a server slowed to a crawl by a
busy processor or one about to have Postfix OOM-killed looked entirely
healthy until the queue backed up.

internal/health/machine.go reads the kernel's counters in /proc: the
aggregate processor times and core count from /proc/stat, the load
average from /proc/loadavg, memory and swap from /proc/meminfo, and
per-interface byte counters from /proc/net/dev.

CPU busy time and network throughput are rates, so a MachineSampler holds
the previous reading and each call reports the difference — one shared
sampler on the Server, since a per-request one would never have anything
to subtract. A window longer than a minute only re-baselines: a page
opened after the panel sat idle would otherwise average that whole
stretch and present it as the current load.

Memory is derived from MemAvailable rather than MemFree, because Linux
spends every spare page on cache and MemFree would report a permanent
emergency. A fully busy processor (>=90%) warns and an exhausted machine
(>=97%) errors, both counting towards the page's headline verdict, since
either delays or kills the mail path. Throughput has no comparable
threshold — what counts as a lot depends on the link — so it is reported
and never graded. Loopback is excluded: that traffic is the container
talking to itself.

Like every other check here, an unreadable counter degrades to "unknown"
with an explanation instead of failing the page, so the panel still runs
outside Linux for development.

The usage bars are <meter> elements. The panel's CSP has no inline-style
exemption, so a bar's length has to travel on an attribute; the element
also grades its own colour from low/high/optimum, and the percentage is
printed beside it for anything that does not render meters.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -190,7 +190,13 @@ service healthy and will mail be accepted?"
 
 - **Status** (`/status`) — supervised processes (Postfix, OpenDKIM, panel),
   TLS certificate validity and expiry, milter socket presence, and a short
-  Postfix queue summary. The hostname block compares `SELFPOST_HOSTNAME`
+  Postfix queue summary. The **Machine** card adds the resource usage of the
+  host underneath — processor (with the load average), memory and swap, and
+  per-interface network throughput and totals — read from the kernel's
+  counters; CPU and throughput are measured between refreshes, so they appear
+  one refresh after the page opens. A fully busy processor or a machine out of
+  memory is a warning here, because both delay or kill the mail path;
+  throughput is only reported. The hostname block compares `SELFPOST_HOSTNAME`
   against the PTR record the internet publishes for this server's IP
   (forward-confirmed reverse DNS); use *Re-check* after changing DNS. The
   **Reload configuration** button re-applies OpenDKIM tables and the Postfix