Add endpoint monitor catalog and warn-only drift reconciler

Operators need to see when a machine's running services or processes fall outside the desired state defined by policy. This adds a reusable monitor catalog (shipped read-only rows plus user-built local rows), computes drift server-side on agent check-in, and surfaces a warning on the endpoint panels. Remediation stays manual for now; automation can follow once demand is proven. Includes migrations 0006-0008 and the monitors API client.

frontend/src/api/index.js

@@ -178,6 +178,25 @@ export const endpointsApi = {
   },
   telemetryMeta(assetId) {
     return api.get(`/endpoints/asset/${assetId}/telemetrymeta`)
+  },
+  // Monitor catalog: reusable process/service definitions. Shipped rows are
+  // product-owned and read-only; local rows are user-built on the Settings page.
+  monitors: {
+    list() {
+      return api.get('/endpoints/monitors')
+    },
+    create(data) {
+      return api.post('/endpoints/monitors', data)
+    },
+    update(monitorid, data) {
+      return api.put(`/endpoints/monitors/${monitorid}`, data)
+    },
+    remove(monitorid) {
+      return api.delete(`/endpoints/monitors/${monitorid}`)
+    },
+    resolve(pctype) {
+      return api.get('/endpoints/monitors/resolve', { params: { pctype } })
+    }
   }
 }