feat: push system health and capability readiness refreshes

[atomantic]

System Resources and Setup & Capabilities now load once and refresh from socket invalidations, reconnects, and tab re-show instead of polling every 15/20 seconds.

• Reuse the shared single-flight resource hook, with visible stale-read errors and listener cleanup.
• Forward settings, CoS health/lifecycle/memory, app, provider-status and media events; notify after provider/account/genome/Telegram/PM2 mutations.
• Share one change-detecting server observer for external readiness and telemetry while consumers are subscribed. It stops after the last unsubscribe, never starts model generation or loads a model, and emits empty invalidations rather than private snapshots.
• Extract the existing aggregate readers so HTTP and observation share probe semantics. Failed capability probes remain degraded instead of appearing unconfigured. Existing HTTP and socket authentication boundaries remain in place.

Validation: 22 rendered client tests; targeted server integration and observer lifecycle tests; snapshot import smoke; final npm run pregate passed 798 server suites (19,986 tests, one skipped), 28 client suites (211 tests), client lint and hidden-content scan. CI supplies Windows, build and boot-smoke verification.

Closes #8553
Part of #8530