Fleet monitoring: sysstat 28d + perfsnap/PSI/iotop timers + on-demand toolbox container (#826)

- monitoring/node-install.sh: idempotent per-node installer (sar HISTORY=28,
  three oneshot timers, per-node conf with qemu.slice/lxc cgroup globs)
- monitoring/collectors + systemd units: iotop-snap 15min, perfsnap 60s,
  psi-textfile 15s (now sources /etc/knelperf/perfsnap.conf; multi-glob)
- monitoring/toolbox: pct LXC (vmid 950, privileged, apparmor unconfined,
  stopped at rest) + knelperf-toolbox wrapper + Dockerfile variant
- monitoring/deploy-fleet.sh: workstation-side rollout driver
- piloted on pfv-tsys1: per-VM PSI gauges verified live

Redmine: https://projects.knownelement.com/issues/826

monitoring/toolbox/Dockerfile

@@ -0,0 +1,16 @@
+# knelperf-toolbox — Docker image variant for docker-capable hosts
+# (workstation, VMs). On PVE nodes the LXC variant (lxc-toolbox.sh) is
+# canonical. Package list is shared: toolbox-pkgs.txt.
+# Build:  docker build -t git.knownelement.com/knel/knelperf-toolbox:v1 \
+#           -f monitoring/toolbox/Dockerfile monitoring/toolbox/
+# Docs: https://community.turnsys.com/t/328
+FROM debian:12.9-slim
+
+COPY toolbox-pkgs.txt /tmp/toolbox-pkgs.txt
+RUN apt-get update -qq && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      $(sed 's/#.*//' /tmp/toolbox-pkgs.txt | tr '\n' ' ') && \
+    rm -rf /var/lib/apt/lists/* /tmp/toolbox-pkgs.txt
+
+WORKDIR /work
+ENTRYPOINT ["/bin/bash"]