feat(hosts): surface per-host connectivity on /hosts; drop the unwritable table (#521)

`IHostConnectivityProbe` was a dead surface: eleven drivers implement it, `GetHostStatuses()`
had ZERO production call sites, and `OnHostStatusChanged` had no subscriber outside the Galaxy
driver's own aggregator. Per-host connectivity was computed by every driver and read by nobody.

The issue offered "build the publisher or delete it". The publisher as its entity doc described
it — driver nodes upserting `DriverHostStatus` rows — is not buildable: per-cluster mesh Phase 4
gates `AddOtOpcUaConfigDb` on the `admin` role, so a driver-only node has no ConfigDb connection
to write rows with. So the capability is kept and the transport changed.

`DriverHealthChanged.HostStatuses` now carries the probe result to `/hosts` as a Hosts column.
That channel already reached the page, already survives the mesh split via the Phase 5 gRPC
telemetry stream, and already replays a last-value snapshot on re-subscribe — so per-host state
re-primes after a reconnect without a durable store. Both halves of the interface finally do
what they are for: the event triggers a prompt publish, the pull is the source of truth.

The point of the column is the case the driver-level state chip structurally cannot express: a
multi-device driver stays aggregate-Healthy while ONE of its devices is unreachable.

Two traps, both pinned by tests that were falsified against the prod code:

- The host digest MUST be in the publish fingerprint. On a single-host-down transition every
  other fingerprint component is unchanged, so the dedup would swallow exactly the publish
  carrying the news — the trap that already bit the rediscovery signal. Removing it turns the
  guard test red, verified.
- null (no probe) must stay distinct from empty (probe with no hosts). proto3 cannot tell an
  absent repeated field from an empty one, hence the explicit `has_host_statuses` flag;
  collapsing them would render every probe-less driver as one whose devices are all fine.

Dropped: the DriverHostStatus entity, enum, DbSet, model config and table (migration
DropDriverHostStatusTable — empty on every deployment, so the scaffolder's data-loss warning is
moot, and Down() recreates it exactly).

Found en route, NOT fixed here: `DriverInstanceResilienceStatus` is the identical defect — no
writer, no reader, only a DbSet declaration, while the live data rides the
`driver-resilience-status` telemetry channel. Its doc-comment now states that rather than
describing the sampler and AdminUI join that were never built. Filed as #524 rather than widening
this schema change beyond what was asked.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Hosts.razor

@@ -168,6 +168,7 @@ else
                                 <th>Driver</th>
                                 <th>Type</th>
                                 <th>Status</th>
+                                <th>Hosts</th>
                                 <th>Last read</th>
                                 <th>Errors/5 min</th>
                                 <th>Last error</th>
@@ -177,7 +178,7 @@ else
                             @if (g.Drivers.Count == 0)
                             {
                                 <tr>
-                                    <td colspan="6"><span class="text-muted">No drivers.</span></td>
+                                    <td colspan="7"><span class="text-muted">No drivers.</span></td>
                                 </tr>
                             }
                             else
@@ -204,6 +205,28 @@ else
                                         </td>
                                         <td>@(d.DriverType ?? "—")</td>
                                         <td><span class="chip @DriverChipClass(d.State)">@d.State</span></td>
+                                        <td>
+                                            @* Per-host connectivity (Gitea #521). The point of this column is the case
+                                               the driver-level Status chip cannot express: a multi-device driver stays
+                                               Healthy in aggregate while ONE of its PLCs is unreachable. A driver with
+                                               no probe shows "—" — deliberately distinct from a probe reporting zero
+                                               hosts, which shows "0 hosts". *@
+                                            @if (d.HostStatuses is null)
+                                            {
+                                                <span class="text-muted">—</span>
+                                            }
+                                            else if (d.DegradedHosts.Count == 0)
+                                            {
+                                                <span class="text-muted small">@d.HostStatuses.Count hosts</span>
+                                            }
+                                            else
+                                            {
+                                                <span class="chip chip-warn"
+                                                      title="@DegradedHostTitle(d)">
+                                                    @d.DegradedHosts.Count / @d.HostStatuses.Count down
+                                                </span>
+                                            }
+                                        </td>
                                         <td>@(d.LastSuccessfulReadUtc?.ToString("HH:mm:ss 'UTC'") ?? "—")</td>
                                         <td class="numeric">@d.ErrorCount5Min</td>
                                         <td><span class="text-muted small">@(d.LastError ?? "—")</span></td>
@@ -355,6 +378,13 @@ else
         _              => "chip-idle",
     };
 
+    // Tooltip listing each host that is not Running, with its state and when it last changed. Built in
+    // C# rather than inline in the markup so the string is composed once per render, and so the row can
+    // never be the thing that 500s the page — string.Join over an already-materialised list does no
+    // indexing (cf. #504, where slicing a short DB string in Razor took down the whole page).
+    private static string DegradedHostTitle(HostsDriverRow d) =>
+        string.Join(" · ", d.DegradedHosts.Select(h => $"{h.HostName}: {h.State} since {h.LastChangedUtc:u}"));
+
     public async ValueTask DisposeAsync()
     {
         // Unsubscribe first so the singleton store can't invoke a handler on a disposed component.