fleet-manager: chrony tracking metrics relative to the NTP source

The agent only reported chrony as synced|unsynced — nothing about how well the
clock tracks. Parse `chronyc tracking` for the source-relative metrics.

- proto: HealthSnapshot.chrony_offset_seconds (16, signed system-time offset,
  fast=+), chrony_source (17, reference name/IP), chrony_stratum (18); regenerated.
- agent: replace chronyState() with chronyTracking()/parseChrony() — one exec,
  parses Leap status + Reference ID + Stratum + System time offset (+ test).
- manager: Health.{ChronyOffset,ChronySource,ChronyStratum}; snapshotToHealth maps
  them; influx writes chrony_offset_seconds/_stratum/_source and whitelists the
  offset + stratum as graphable fields.
- UI: chronySummary() + offsetMs() — the chrony row now shows
  "synced · 192.168.50.10 · s3 · +0.01ms" instead of just "synced".

serving/fleet-manager/proto/fleet_agent.proto

@@ -59,6 +59,10 @@ message HealthSnapshot {
   string display         = 14;
   int64  uptime_seconds  = 15;  // HOST uptime (seconds since boot) — boot_time =
                                 // manager receive-time - this; drives reboot-pending
+  // chrony tracking relative to the NTP source (from `chronyc tracking`):
+  double chrony_offset_seconds = 16; // system time offset from NTP (signed, fast=+)
+  string chrony_source         = 17; // reference source name/IP (which server)
+  int32  chrony_stratum        = 18; // hops from a reference clock (0 = unsynced)
 }
 
 message CommandResult {