Phase 5: multi-host agents (0.5.0)

- stackpilot-agent: slim token-guarded FastAPI (reuses compose_service) exposing
  stack CRUD/lifecycle/logs + system info; same image, different CMD. agent/
  Dockerfile + compose + .env.example.
- Central proxy: Agent model, agent_service (httpx ping/proxy + live status:
  online/offline/unauthorized + hostname/last_seen), routers/agents.py
  (CRUD + ping + proxied stacks/lifecycle/logs/system).
- Frontend: Settings → Remote hosts (add/check/remove, connectivity dot); Stacks
  grouped by host; remote stack detail with lifecycle, live logs, compose/.env edit.

Verified end-to-end: agent+main on a shared network — register (good/bad token),
list/create/start/logs/delete remote stacks, offline detection (502).

Remote backup destinations (SFTP/S3) deferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/config.py

@@ -35,6 +35,10 @@ class Settings(BaseSettings):
     # Throwaway image used to read/write named-volume contents during backup.
     BACKUP_HELPER_IMAGE: str = "alpine:latest"
 
+    # Multi-host agent: shared bearer token the agent requires on every request.
+    # Only used when running the agent app (agent_app:app).
+    AGENT_TOKEN: str = ""
+
     # Host browser sandbox roots
     ALLOWED_BROWSE_ROOTS: Annotated[list[str], NoDecode] = [
         "/", "/mnt", "/media", "/srv", "/opt",