feat(kuma): Cloudron HTTP-200 coverage + group discipline [#435]

55 http monitors added under "Cloud Systems" (blue/green: canary first,
verified green); 9 root-level strays re-homed into founder's groups
(root now zero). New tools: inventory (read-only dump), cloudron-sync
(idempotent diff/add from committed app list), regroup (lib-based moves;
raw editMonitor times out on this build). fleet-sync now requires
--group-id so it can never place monitors at root again.

Results: https://projects.knownelement.com/issues/435#note-4

scripts/kuma-fleet-sync.py

@@ -106,7 +106,16 @@ def kuma_connect():
 def main():
     ap = argparse.ArgumentParser()
     ap.add_argument("--add", action="store_true", help="create missing monitors")
+    ap.add_argument(
+        "--group-id",
+        type=int,
+        default=0,
+        help="parent group id for new monitors (REQUIRED — root placement "
+        "is banned per founder ruling 2026-09-02; use groups)",
+    )
     args = ap.parse_args()
+    if args.add and not args.group_id:
+        raise SystemExit("--group-id is required with --add (no root monitors)")
 
     targets = fleet_targets()
     sio, mons = kuma_connect()
@@ -140,6 +149,7 @@ def main():
                 "conditions": [],
                 "active": host not in PAUSED_BY_DEFAULT,
                 "packetSize": 56,
+                "parent": args.group_id,
             }
             r = sio.call("add", payload, timeout=30)
             ok = isinstance(r, dict) and r.get("ok")