[SandObserver]

Depends on #123, and is branched from it. Merge that first; this will be rebased onto main afterwards.

Summary

• Add beszel to statProvider, with beszelUrl, beszelUser, a beszelPass secret, and a beszelSystem picker fed by a systems endpoint.
• Declare a third copy of the slots group for Beszel: no Processes option, a sensor picker, filesystem-name labels for the two disk fields, and a group hint naming what the source does not report.
• Authenticate against _superusers then users, caching the collection that answers together with its token, keyed by host.
• Retry an empty list once with a fresh session, since PocketBase answers a stale token with an empty read rather than a refusal, so expiry and an empty hub are otherwise identical.
• Map the latest system_stats record of type 1m onto the widget's shape: cpu, mp, dp/d for the root filesystem, efs by name for the rest, t for named sensors, cpub[2] for IO wait, and the system record's info.u for uptime.
• Route the sensors endpoint through the provider dispatch, so each source fills the picker from its own sensor names.

Testing
All green, including the Docker build. Added 10 tests for the provider, covering slot mapping, root and named filesystems, collection fallback and session reuse, session renewal on an empty read, a genuinely empty hub, a rejected password, a removed system, and both pickers.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.