feat(infra): commit live infra-audit/cluster work to reconcile git with prod

This work (network_hosts inventory + infra_audit MCP tool, /api/cluster +
Sacred Valley cluster card, topbar cluster-health pill + SW self-heal) was
built in an earlier session and DEPLOYED to CT 311 as alpha.24–26, but was
never committed to git — prod was running code absent from the repo. Commits
it as-is (already prod-validated) so git matches the live state, and restores
its alpha.24/25/26 CHANGELOG entries. Files are disjoint from the fold-in
work; both now ship together under alpha.27.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/db/repos/network_hosts.js

@@ -0,0 +1,28 @@
+import { pool } from '../pool.js';
+
+const COLS = 'id, kind, name, node, ip, mac, note, updated_at';
+
+// Authoritative guest/host LAN inventory (id -> ip -> mac). Read-only here; the
+// canonical seed lives in migration 023. Used by the infra_audit sanity check
+// and as the source for router DHCP reservations.
+export async function all() {
+  const { rows } = await pool.query(`SELECT ${COLS} FROM network_hosts ORDER BY id`);
+  return rows;
+}
+
+export async function get(id) {
+  const { rows: [r] } = await pool.query(`SELECT ${COLS} FROM network_hosts WHERE id=$1`, [id]);
+  return r || null;
+}
+
+// Hosts still missing a captured MAC (e.g. the Pi when it was down at seed time).
+export async function missingMac() {
+  const { rows } = await pool.query(`SELECT ${COLS} FROM network_hosts WHERE mac IS NULL ORDER BY id`);
+  return rows;
+}
+
+export async function setMac(id, mac) {
+  const { rows: [r] } = await pool.query(
+    `UPDATE network_hosts SET mac=$2, updated_at=now() WHERE id=$1 RETURNING ${COLS}`, [id, mac]);
+  return r || null;
+}