Add endpoint monitor catalog and warn-only drift reconciler

Operators need to see when a machine's running services or processes fall outside the desired state defined by policy. This adds a reusable monitor catalog (shipped read-only rows plus user-built local rows), computes drift server-side on agent check-in, and surfaces a warning on the endpoint panels. Remediation stays manual for now; automation can follow once demand is proven. Includes migrations 0006-0008 and the monitors API client.

plugins/endpoints/frontend/views/AgentKeySettings.vue

@@ -307,7 +307,7 @@
     </section>
 
     <!-- ====================================================================
-         Agent configuration (placeholder)
+         Agent configuration
          ================================================================= -->
     <section class="settings-section">
       <h3>Agent configuration</h3>
@@ -319,11 +319,16 @@
           stamped into the build above so a deployed agent needs no local edits.
         </p>
         <p class="field-hint">
-          <strong>Coming soon.</strong> These controls arrive with the C# agent
-          runtime. Until then the agent uses its built-in defaults.
+          Monitored processes and services are defined as reusable monitors and
+          attached to PC types through site policies, so a deployed agent fetches
+          the right set for its type.
         </p>
-        <button class="btn btn-secondary" type="button" disabled>
-          Edit configuration (coming soon)
+        <button
+          class="btn btn-secondary"
+          type="button"
+          @click="editConfiguration"
+        >
+          Edit configuration
         </button>
       </div>
     </section>
@@ -332,8 +337,10 @@
 
 <script setup>
 import { ref, onMounted } from 'vue'
+import { useRouter } from 'vue-router'
 import api from '@/api'
 
+const router = useRouter()
 const loading = ref(true)
 const busy = ref(false)
 const key = ref(null)
@@ -540,6 +547,10 @@ async function buildSiteAgent() {
     agentbusy.value = false
   }
 }
+
+function editConfiguration() {
+  router.push({ name: 'endpoints-monitors-settings' })
+}
 </script>
 
 <style scoped>