Merge wilm: gevent migration, endpoint telemetry phase 2, backup/restore

Brings in 98 commits from wilm (origin/wilm @ 811e6ca61a):

Major features:
- Move API to gevent workers for better concurrency
- Endpoint agent startup jitter (prevents thundering herd)
- Complete backup/restore with restic
- Endpoint telemetry phase 2 (disk health, mapped drives, user context)
- PC Detail UI rework with new cards and tabs
- Dell Command actions and Corporate Tools tab
- Agent version column in Fleet view

Conflict resolution:
- Backup/restore: Accepted wilm implementation (10 files)
- Agent startup jitter: Accepted wilm v1.12.0
- PC Types list fix: Accepted wilm version
- Endpoint plugin domain clamping: Kept ours (defensive)
- Test files: Accepted wilm versions for consistency

Testing required:
- Verify gevent handles concurrent requests
- Test backup/restore functionality
- Verify agent startup jitter timing
- Test endpoint telemetry collection
- Validate PC Detail UI changes

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

plugins/endpoints/api/routes.py

@@ -1828,6 +1828,25 @@ def revoke_agentkey():
 # How long the agent claim poll is held open server-side before returning empty.
 # Kept below the agent HttpClient timeout and typical proxy idle timeouts so a
 # quiet fleet re-polls cleanly instead of tripping a read timeout.
+#
+# 25s is the value this endpoint is designed around; it was temporarily dropped
+# to 5s under the blocking gthread worker pool, where a held connection pinned
+# one of a worker's 8 OS threads. Measured then: 14 agents at hold=25 left a
+# single worker with 8 of 9 threads parked in timed sleep and UI requests hashed
+# to that worker waited 12-24s. Under gevent a held connection is a greenlet and
+# the per-worker ceiling is --worker-connections (2000), not 8 threads, so an
+# idle hold no longer costs anything a UI request needs.
+#
+# Restored to 25 because hold length sets the fleet's REQUEST RATE, not its
+# concurrency: the agent re-polls immediately on a 204, so hold=5 is 5x the
+# requests of hold=25, and TLS handshake CPU was the measured burst bottleneck
+# (devnotes/gevent-sizing-simulation.md). 25 also restores the margin against
+# the agent's MinIdlePollDuration=5s floor, which CommandWorker.IsIdlePollClose
+# uses to tell a normal hold-window close apart from a transient failure; at
+# hold=5 that margin was ~20ms.
+#
+# Constraint: gunicorn --timeout must stay above this or a healthy long-poll is
+# killed mid-hold. docker-compose.yml sets 60.
 _CLAIM_HOLD_SECONDS = 25
 _CLAIM_POLL_INTERVAL = 1.0
 

plugins/endpoints/api/siteagent.py

@@ -118,6 +118,7 @@ _BASE_APPSETTINGS = {
     'apikey': 'REPLACE_WITH_COLLECTOR_KEY',
     'cadenceseconds': 900,
     'jitterseconds': 60,
+    'startupjitterseconds': 30,
     'adoptonfirstrun': True,
     'utilitiespath': '',
     'logpath': '',