feat(hosts): surface per-host connectivity on /hosts; drop the unwritable table (#521)

`IHostConnectivityProbe` was a dead surface: eleven drivers implement it, `GetHostStatuses()`
had ZERO production call sites, and `OnHostStatusChanged` had no subscriber outside the Galaxy
driver's own aggregator. Per-host connectivity was computed by every driver and read by nobody.

The issue offered "build the publisher or delete it". The publisher as its entity doc described
it — driver nodes upserting `DriverHostStatus` rows — is not buildable: per-cluster mesh Phase 4
gates `AddOtOpcUaConfigDb` on the `admin` role, so a driver-only node has no ConfigDb connection
to write rows with. So the capability is kept and the transport changed.

`DriverHealthChanged.HostStatuses` now carries the probe result to `/hosts` as a Hosts column.
That channel already reached the page, already survives the mesh split via the Phase 5 gRPC
telemetry stream, and already replays a last-value snapshot on re-subscribe — so per-host state
re-primes after a reconnect without a durable store. Both halves of the interface finally do
what they are for: the event triggers a prompt publish, the pull is the source of truth.

The point of the column is the case the driver-level state chip structurally cannot express: a
multi-device driver stays aggregate-Healthy while ONE of its devices is unreachable.

Two traps, both pinned by tests that were falsified against the prod code:

- The host digest MUST be in the publish fingerprint. On a single-host-down transition every
  other fingerprint component is unchanged, so the dedup would swallow exactly the publish
  carrying the news — the trap that already bit the rediscovery signal. Removing it turns the
  guard test red, verified.
- null (no probe) must stay distinct from empty (probe with no hosts). proto3 cannot tell an
  absent repeated field from an empty one, hence the explicit `has_host_statuses` flag;
  collapsing them would render every probe-less driver as one whose devices are all fine.

Dropped: the DriverHostStatus entity, enum, DbSet, model config and table (migration
DropDriverHostStatusTable — empty on every deployment, so the scaffolder's data-loss warning is
moot, and Down() recreates it exactly).

Found en route, NOT fixed here: `DriverInstanceResilienceStatus` is the identical defect — no
writer, no reader, only a DbSet declaration, while the live data rides the
`driver-resilience-status` telemetry channel. Its doc-comment now states that rather than
describing the sampler and AdminUI join that were never built. Filed as #524 rather than widening
this schema change beyond what was asked.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hosts/HostsDriverView.cs

@@ -1,6 +1,7 @@
 namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hosts;
 
 using ZB.MOM.WW.OtOpcUa.Commons.Messages.Drivers;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 
 /// <summary>
 ///     One configured host node within a cluster, as the <c>/hosts</c> page needs it: the cluster
@@ -40,10 +41,26 @@ public sealed record HostsDriverInstanceInfo(string DriverInstanceId, string Clu
 ///     is unchanged and an operator must re-browse the device via <c>/raw</c> to pick anything up.</param>
 /// <param name="RediscoveryReason">The driver-supplied reason for that report; null when
 ///     <paramref name="RediscoveryNeededUtc"/> is null.</param>
+/// <param name="HostStatuses">Per-host connectivity for a multi-device driver, ordered by host name; null
+///     when the driver reports no per-host detail. Lets one unreachable device show even while the driver
+///     row itself is Healthy.</param>
 public sealed record HostsDriverRow(
     string DriverInstanceId, string? Name, string? DriverType, string State,
     DateTime? LastSuccessfulReadUtc, string? LastError, int ErrorCount5Min, DateTime PublishedUtc,
-    DateTime? RediscoveryNeededUtc = null, string? RediscoveryReason = null);
+    DateTime? RediscoveryNeededUtc = null, string? RediscoveryReason = null,
+    IReadOnlyList<HostConnectivityStatus>? HostStatuses = null)
+{
+    /// <summary>Hosts that are not <see cref="HostState.Running"/>, ordered by name — the ones worth an
+    /// operator's attention. Empty when every host is fine or none are reported.
+    /// <para><see cref="HostState.Unknown"/> counts as degraded on purpose: a probe that has not yet
+    /// completed its first tick, or one a driver failed to start (AbCip logs exactly this case), reports
+    /// Unknown — and silently rendering that as healthy is how the gap got missed the first time.</para></summary>
+    public IReadOnlyList<HostConnectivityStatus> DegradedHosts { get; } =
+        (HostStatuses ?? [])
+            .Where(h => h.State != HostState.Running)
+            .OrderBy(h => h.HostName, StringComparer.OrdinalIgnoreCase)
+            .ToList();
+}
 
 /// <summary>
 ///     One cluster's section on the <c>/hosts</c> page: its configured nodes plus its enriched
@@ -118,7 +135,8 @@ public static class HostsDriverView
                         s.ErrorCount5Min,
                         s.PublishedUtc,
                         s.RediscoveryNeededUtc,
-                        s.RediscoveryReason);
+                        s.RediscoveryReason,
+                        s.HostStatuses);
                 })
                 .OrderBy(d => d.Name ?? d.DriverInstanceId, StringComparer.OrdinalIgnoreCase)
                 .ThenBy(d => d.DriverInstanceId, StringComparer.OrdinalIgnoreCase)