fleet-manager: chrony tracking metrics relative to the NTP source

The agent only reported chrony as synced|unsynced — nothing about how well the
clock tracks. Parse `chronyc tracking` for the source-relative metrics.

- proto: HealthSnapshot.chrony_offset_seconds (16, signed system-time offset,
  fast=+), chrony_source (17, reference name/IP), chrony_stratum (18); regenerated.
- agent: replace chronyState() with chronyTracking()/parseChrony() — one exec,
  parses Leap status + Reference ID + Stratum + System time offset (+ test).
- manager: Health.{ChronyOffset,ChronySource,ChronyStratum}; snapshotToHealth maps
  them; influx writes chrony_offset_seconds/_stratum/_source and whitelists the
  offset + stratum as graphable fields.
- UI: chronySummary() + offsetMs() — the chrony row now shows
  "synced · 192.168.50.10 · s3 · +0.01ms" instead of just "synced".

serving/fleet-manager/agent.go

@@ -231,6 +231,9 @@ func snapshotToHealth(s *fleetpb.HealthSnapshot) Health {
 		Auth:          s.GetAuth(),
 		SELinux:       s.GetSelinux(),
 		Chrony:        s.GetChrony(),
+		ChronyOffset:  s.GetChronyOffsetSeconds(),
+		ChronySource:  s.GetChronySource(),
+		ChronyStratum: s.GetChronyStratum(),
 		KioskActive:   s.GetKioskActive(),
 		UptimeSeconds: s.GetUptimeSeconds(),
 	}