…st Now

Five UI surfaces wired up against data the agent + monitor were already
collecting but never showing:

1. Agent metrics card (Machines page expanded row)
   New /api/machines/{id}/agent-status proxies the agent's /status through
   the rathole back-channel. The expanded row renders load avg, memory %,
   disk %, agent uptime, hostname, kernel — fetched on demand only when
   the row is open, so collapsed rows have zero cost.

2. Health-check sparkline + uptime %
   monitor.go now writes a HealthCheck row per probe (subject="tunnel:<id>")
   alongside its existing tunnel.Status update. The new
   db.GetHealthSummary aggregates {uptime_percent, recent[]} for the
   24-hour rolling window in one query. Frontend Sparkline renders the
   recent[] as 30 emerald/red squares, right-aligned newest-first.

3. Per-tunnel uptime % column
   New "Uptime" column on the Tunnels page shows colored % (green ≥99,
   amber ≥95, red below) + the sparkline + "last checked" relative time.
   Synthesized SSH/agent rows reuse the parent machine's "machine:<id>"
   subject — they share lifecycle, no point recording separately.

4. Last-seen / last-checked timestamps
   Machines page swaps the absolute toLocaleString last_seen for
   relativeTime ("2m ago"). Tunnel cells show the same. Hover for the
   exact timestamp via title attribute.

5. Test now button
   Per-machine button in the health panel calls the existing
   POST /machines/{id}/health/check endpoint and invalidates
   machine-health + agent-status caches so the new data renders
   immediately, instead of waiting for the next 60s health poll.

Helpers landed in frontend/src/lib/time.ts (relativeTime, formatBytes,
formatDuration). New components: Sparkline, MachineHealthPanel,
TunnelHealthCell. No new tables — everything builds on HealthCheck rows.