monitor: static status page — health, queue, gates, audit tail

- self-contained HTML (no external assets/JS), everything html-escaped
- daemon health from daemon_runs (last status + last run per daemon)
- proposal queue counts by state; human-gate counters (mail drafts awaiting
  approval, content draft/approved)
- audit tail: actor/action/result only — no detail payloads, no addresses,
  no subjects, no content bodies (tests assert the negatives)
- DaemonRun bookkeeping like every other daemon

tests: 3 new (sections render, leak-negatives, XSS escape) — 44 total

tests/test_monitor.py

@@ -0,0 +1,69 @@
+"""monitor tests — page renders, no sensitive data, escapes input."""
+
+from __future__ import annotations
+
+from cayceops.components.monitor import monitor
+from cayceops.models import ContentItem, DaemonRun, MailMessage, Proposal
+
+
+def _seed(sess):
+    sess.add(DaemonRun(daemon="scanner", status="ok", detail={"proposed": 3}))
+    sess.add(Proposal(kind="affiliate", title="Title with <script>alert(1)</script>"))
+    sess.add(
+        MailMessage(
+            direction="in",
+            from_addr="secret-person@private.example.org",
+            subject="private subject",
+            classification="approval",
+            draft_status="drafted",
+        )
+    )
+    sess.add(ContentItem(theme="atm-fees", channel="nostr", caption="caption", status="draft"))
+    sess.flush()
+
+
+def test_build_renders_all_sections(cfg, sess, tmp_path):
+    _seed(sess)
+    out = tmp_path / "status.html"
+    monitor._build(cfg(CAYCE_OPS_MONITOR_OUTPUT=str(out)), sess)
+    page = out.read_text()
+
+    assert "daemon health" in page
+    assert "proposal queue" in page
+    assert "recent audit activity" in page
+    assert "scanner" in page
+    assert "proposed: <strong>1</strong>" in page
+    assert "mail drafts awaiting approval: <strong>1</strong>" in page
+
+
+def test_build_leaks_no_sensitive_data(cfg, sess, tmp_path):
+    _seed(sess)
+    out = tmp_path / "status.html"
+    monitor._build(cfg(CAYCE_OPS_MONITOR_OUTPUT=str(out)), sess)
+    page = out.read_text()
+
+    assert "secret-person@private.example.org" not in page  # no addresses
+    assert "private subject" not in page  # no subjects
+    assert "caption" not in page  # no content bodies
+    assert "Title with" not in page  # proposal titles not rendered
+
+
+def test_build_escapes_injected_content(cfg, sess, tmp_path):
+    from datetime import UTC, datetime
+
+    from cayceops.models import AuditEntry
+
+    sess.add(
+        AuditEntry(
+            ts=datetime.now(UTC),
+            actor="<script>x</script>",
+            action="probe",
+            detail={},
+        )
+    )
+    sess.flush()
+    out = tmp_path / "status.html"
+    monitor._build(cfg(CAYCE_OPS_MONITOR_OUTPUT=str(out)), sess)
+    page = out.read_text()
+    assert "<script>x</script>" not in page
+    assert "&lt;script&gt;x&lt;/script&gt;" in page