fleet-manager: chrony tracking metrics relative to the NTP source

The agent only reported chrony as synced|unsynced — nothing about how well the
clock tracks. Parse `chronyc tracking` for the source-relative metrics.

- proto: HealthSnapshot.chrony_offset_seconds (16, signed system-time offset,
  fast=+), chrony_source (17, reference name/IP), chrony_stratum (18); regenerated.
- agent: replace chronyState() with chronyTracking()/parseChrony() — one exec,
  parses Leap status + Reference ID + Stratum + System time offset (+ test).
- manager: Health.{ChronyOffset,ChronySource,ChronyStratum}; snapshotToHealth maps
  them; influx writes chrony_offset_seconds/_stratum/_source and whitelists the
  offset + stratum as graphable fields.
- UI: chronySummary() + offsetMs() — the chrony row now shows
  "synced · 192.168.50.10 · s3 · +0.01ms" instead of just "synced".

serving/fleet-manager/inventory.go

@@ -53,11 +53,14 @@ type Health struct {
 	CPUPct        float64 `json:"cpu_pct,omitempty"`
 	TempC         float64 `json:"temp_c,omitempty"`
 	MemUsedPct    float64 `json:"mem_used_pct,omitempty"`
-	TmpfsUsedPct  float64 `json:"tmpfs_used_pct,omitempty"` // overlay RAM pressure (ties to #17)
-	NVMeRoot      string  `json:"nvme_root,omitempty"`      // ok|degraded|down
-	Auth          string  `json:"auth,omitempty"`           // 802.1x/macsec: up|down
-	SELinux       string  `json:"selinux,omitempty"`        // enforcing|permissive
-	Chrony        string  `json:"chrony,omitempty"`         // synced|unsynced
+	TmpfsUsedPct  float64 `json:"tmpfs_used_pct,omitempty"`        // overlay RAM pressure (ties to #17)
+	NVMeRoot      string  `json:"nvme_root,omitempty"`             // ok|degraded|down
+	Auth          string  `json:"auth,omitempty"`                  // 802.1x/macsec: up|down
+	SELinux       string  `json:"selinux,omitempty"`               // enforcing|permissive
+	Chrony        string  `json:"chrony,omitempty"`                // synced|unsynced
+	ChronyOffset  float64 `json:"chrony_offset_seconds,omitempty"` // system time offset from NTP (signed, fast=+)
+	ChronySource  string  `json:"chrony_source,omitempty"`         // NTP reference source name/IP
+	ChronyStratum int32   `json:"chrony_stratum,omitempty"`        // hops from a reference clock
 	KioskActive   bool    `json:"kiosk_active"`
 	UptimeSeconds int64   `json:"uptime_seconds,omitempty"` // host uptime at last report; boot_time = last_seen - this (reboot-pending)
 }