[SandObserver]

Summary

• Add api/src/proxmox.js: Proxmox VE API client with PVEAPIToken auth, token ID and secret validation before the header is built, and coded errors for refused tokens, missing permissions and non-Proxmox replies.
• Add a Proxmox health check type. /api/health reads every guest from one shared /cluster/resources?type=vm request, ignores templates, and reports a running, stopped, missing or unknown (no current stats) guest.
• Add POST /api/proxmox/test (guest count) and GET /api/proxmox/guests (guest picker), with a demo-mode list.
• Store the Proxmox connection in settings.server.proxmox. The secret is scrubbed from config responses and exports, and is restored on save only while address, token ID and certificate setting are unchanged; otherwise it is reported as withheld.
• Replace the Docker health checks switch with settings.server.healthChecks, which gates Ping, Container and Proxmox checks and reveals Hide Healthy Badge, Docker Socket URL and the Proxmox connection. Absent counts as on, so existing configs keep their badges.
• Add Proxmox as a System Summary source: node status for CPU, RAM, IO wait, uptime and root filesystem, node storage for storage-ID disk slots, a node picker, and the only node used when none is chosen.
• Drop the query and fragment from a Proxmox address, so the address of a Proxmox UI tab works.
• Add the new strings to all six catalogs, and remove the socket-URL-required toast.

Testing
All green, including e2e and against a live Proxmox VE 9.2.2. Added 39 tests for the API client, health route, secret handling, widget source and badge reasons.

Changelog

Added

• Add a Proxmox health check that shows whether a VM or container is running.
• Add Proxmox VE as a System Summary source.

Changed

• Replace the Docker health checks switch with one Health Checks switch that covers every check type.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.