feat(agent): add fly agent run, the base of the monitoring agent

[nabil1440]

Layer 1 of 7 of the monitoring agent (#31 → #37). It follows the FlyWP monitoring agent contract v0.2.1.

Summary

• This PR adds the command fly agent run. systemd starts it on each server, as the server user.
• The agent reads three values: the control plane URL, the token and the server id. It keeps its files in the state folder of systemd.
• Only one agent can operate at a time. The agent works at a fixed second of each minute, which the server id sets. Thus, the servers do not all send at the same time.
• The agent operates without Docker, and it does not operate as root.
• In this layer, the agent sends no data. The next layers add the data.

Change

• cmd/agent.go: fly agent run. It stops on SIGTERM with exit 0.
• internal/agent: the configuration (FLY_AGENT_URL, FLY_AGENT_TOKEN, FLY_AGENT_SERVER_ID, STATE_DIRECTORY), the lock, the schedule and the client for the control plane.
• internal/statefile: JSON files that survive a crash (temporary file, sync, rename, sync of the folder).

Adversarial review

The first version was refuted. These items are fixed in this PR:

• The client did not refuse redirects. A redirect could drop samples (a POST replayed as a GET) or send the token over http. A 3xx now keeps the data.
• Retry-After is at most one hour.
• A wall clock that steps back cannot run the same tick two times.
• The URL must not hold a user, a password, a query or a fragment, and an error never shows a password. The token must be printable ASCII.
• The agent removes the temporary files of a crash at start.
• A flaky Docker test (older than this work) has more time under load.

Tests

• Unit tests for the configuration, the lock, the schedule (with a clock step) and the client (redirects, Retry-After, status errors).
• The loop runs under testing/synctest.
• End-to-end: configuration errors exit 1, a second agent stops, the agent runs without Docker, SIGTERM gives exit 0, and the log has no token.

Refs #26 (#32 completes it: the report interval in state.json)