chore(agent): phase roadmap from TODO.md, 5 phases

The five UI items in TODO.md become an executable pipeline. Planning files
only — no application code changed.

- 01_severity_language: one Python threshold table + `severity` on the
  values the pages colour, plus the .hero style. Today the thresholds are
  magic numbers at six JS call sites (75/90 here, 80/92 there), which is
  exactly how "same colour, four meanings" happens.
- 02_overview_fleet_and_alerts: /api/summary gains a derived `alerts`
  list; the page drops to fleet + warnings. Unconfigured sources must not
  alert — that is invariant 3, tested.
- 03_system_per_host_panels: per-host hero cards, no per-core, shared
  multi-host charts and the detail picker deleted. The six card metrics
  already exist in the payload, so the first task pins them with tests
  instead of inventing fields.
- 04_llm_chart_readability: charts.js already exports sparkline() and no
  page calls it — that is why the page reads flat. Port llm_monitor's
  drawSpark behaviour (fixed max, right growth, p95 foots) and keep the
  provenance tags.
- 05_ups_hero_battery_glyph: charge/load/runtime hero + an SVG battery
  whose fill is the charge, verified against both real UPSes and the
  low-charge/on-battery states only the simulator can produce.

PLAN.md records the ratified anchors and the deviation worth knowing:
severity vocabulary is ok|warn|fail, matching dash.css and nut.py, not the
"danger" wording in the proposal — one synonym for one colour.

TODO.md cleared to a bare heading; the items are now phases. .gitignore
stops ignoring all of .agents/ (the roadmap is project history) while
keeping phase-sessions/ and pipeline.log out. deploy/nut-sudoers rewritten:
its header still blamed a port mystery that is solved; the remaining need
is reading upsd.users so adding a scoped dashboards user does not delete
the accounts upsmon authenticates as.

LLM-Generated: true

AGENTS.md

@@ -4,6 +4,19 @@ The plan, the rules, and the environment facts an agent needs to work on this re
 re-deriving them. `README.md` is the operator-facing how-to; this file is the why, the
 invariants, and the state of the fleet.
 
+## Working protocol
+
+This project runs the `.agents/phases/` phased-execution pipeline.
+
+1. Always read `.agents/PLAN.md` first to understand the project context and goals.
+2. Follow the phased execution protocol in `.agents/phases/`.
+3. Never modify `.agents/PLAN.md` or any files in `.agents/phases/complete/`.
+4. If you need to update any file in `.agents/phases/todo/`, you must ask the user for permission first.
+5. Strictly adhere to the **LOCKED DECISIONS** listed in `.agents/PLAN.md`.
+
+Everything below this section is the project's own content: what the app is, the rules that
+keep its numbers honest, and the state of the fleet it watches.
+
 ## What this is
 
 Three dashboards for one homelab, behind one domain, in one process, backed by one SQLite