feat: hetzner provider

[luke-lombardi]

Summary by cubic

Adds the hetzner provider for CPU-only managed private pools and finalizes node-based capacity across the API, events, billing, and SDK/CLI. Also adds private‑pool fallback in the scheduler, hardens agent restarts, improves telemetry redaction, and introduces a CLI command to list offers.

• New Features

  • hetzner provider: lists CPU server offers and launches on Hetzner Cloud Networks (default US regions: ash, hil) with per‑region images/SSH keys, configurable private networking, server type pricing/categories, and region metadata; offers include node_count, display_name/category, region_display_name, latitude/longitude.
  • Node-based capacity: pool configs/requests use nodes; offers/reservations carry node_count, instance_type, cpu_millicores, memory_mb, storage_mb; events emit node_count; billing/metrics include node_count and storage_mb; OpenAPI/proto/SDK/CLI updated (gpus → nodes where applicable). Offer lists sort by per-node or per-GPU cost based on the request.
  • Solver: plans by nodes or GPUs per request while honoring budget and provider/region filters.
  • Scheduler: falls back from a private‑pool capacity miss to regular workers when allowed by pool settings.
  • Agent: systemd adds start‑limit/backoff (StartLimitIntervalSec=300, StartLimitBurst=5, Restart=on-failure, RestartSec=30).
  • Telemetry: redacts bearer tokens and common “API key/token” phrases.
  • CLI: add “pool offers” to list managed capacity offers with provider/region and CPU/GPU filters.
  • Dashboard: sandbox “last_hour” stats return a fixed 60 buckets for stable charts.

• Migration

  • Configure providers.hetzner (API token, base URL, image/SSH keys, and privateNetwork). Ensure the Hetzner Network has a cloud subnet in each target region.
  • For CPU-only pools, set nodes in the pool config or request. Do not combine nodes with gpus or GPU filters (validation enforces this). No changes required for existing GPU-based pools.

^{Written for commit ea4c791. Summary will update on new commits.}