Initial varys-monitor agent

HTTP service reachability checks for 12 services + agent watchdog.
Writes status dashboard to /opt/sites/varys/ and last-run.json for Citadel.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config.yaml

@@ -0,0 +1,36 @@
+# Services varys checks for HTTP reachability.
+# Any HTTP response (including 4xx) = UP. Connection error/timeout = DOWN.
+# Add/remove entries freely — no code changes needed.
+
+services:
+  # Agent infrastructure (on proxy Docker network — reachable by service name)
+  - name: hodor-gateway
+    url: http://hodor-gateway:8200/health
+  - name: citadel-mcp
+    url: http://citadel-mcp:8300/sse
+
+  # Core services
+  - name: open-webui
+    url: http://172.27.40.3:3010
+  - name: nginx-proxy-manager
+    url: http://172.27.40.3:81
+  - name: portainer
+    url: https://172.27.40.3:9443
+  - name: gitea
+    url: http://172.27.40.3:3000
+  - name: uptime-kuma
+    url: http://172.27.40.3:3002
+  - name: headscale
+    url: http://172.27.40.3:8080
+  - name: vaultwarden
+    url: http://172.27.40.3:8222
+  - name: plane
+    url: http://172.27.40.3:8095
+  - name: homarr
+    url: http://172.27.40.3:7575
+  - name: netbox
+    url: http://172.27.40.3:8100
+
+# One-shot agents to watchdog (reads /opt/agent-os/logs/<name>/last-run.json).
+agents:
+  - name: bran-changelog