feat: add categraf collect-config wizard with plugin templates and metric verification - #2224

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@public/n9e-collect-templates/elasticsearch.toml`:
- Around line 20-22: Comment out the username and password entries in the
Elasticsearch template so they are not active by default, preventing
authentication with the known password when only servers are configured. Require
users to explicitly uncomment and configure both credential fields.

In `@public/n9e-collect-templates/ethtool.toml`:
- Line 8: Remove the host-specific ens33 and ens38 values from interface_include
in the ethtool template; leave the example commented out or otherwise make
interface selection derive from the target host so collection does not depend on
fixed interface names.

In `@public/n9e-collect-templates/haproxy.toml`:
- Around line 9-10: Update the TLS settings in
public/n9e-collect-templates/haproxy.toml:9-10 by changing the active ssl_verify
default to true or removing it. In
public/n9e-collect-templates/influxdb.toml:29-36,
public/n9e-collect-templates/tomcat.toml:23-30, and
public/n9e-collect-templates/zookeeper.toml:12-19, change the example
insecure_skip_verify values to false.

In `@public/n9e-collect-templates/kafka.toml`:
- Around line 4-6: Update the comment immediately above the active [[instances]]
block to remove the stale instruction about uncommenting it and instead describe
that the plugin is enabled through this active configuration block.

In `@public/n9e-collect-templates/kubernetes.toml`:
- Around line 37-42: Update the Kubernetes template’s insecure_skip_verify
setting to be disabled by default by commenting it out or setting it to false,
while preserving explicit opt-in for users who require skipped TLS verification.

In `@public/n9e-collect-templates/mongodb.toml`:
- Around line 10-15: Remove the active username and password values from the
MongoDB template by commenting out the username and password entries, while
keeping the surrounding configuration guidance intact. Require users to
explicitly provide secure credentials rather than supplying usable defaults.

In `@public/n9e-collect-templates/nfsclient.toml`:
- Around line 7-25: Correct the user-facing template comments and resynchronize
generated templates: in public/n9e-collect-templates/nfsclient.toml lines 7-25
fix “explictly,” “Symantics,” and “mulitple”; in
public/n9e-collect-templates/nginx_upstream_check.toml lines 16-17 change “it's
is not set” to “it is not set”; in public/n9e-collect-templates/nvidia_smi.toml
lines 16-17 change “date collection” to “data collection”; and in
public/n9e-collect-templates/phpfpm.toml lines 4-6 describe PHP-FPM endpoints
rather than Nginx stub_status URIs. Then rerun the template synchronization
script.

In `@public/n9e-collect-templates/nvidia_smi.toml`:
- Around line 8-10: Update the commented nvidia_smi_command example to remove
insecure SSH options that disable host-key verification and discard known hosts.
Require strict host-key checking and configure a secure, persistent known-hosts
database instead.

In `@public/n9e-collect-templates/postgresql.toml`:
- Around line 42-49: Replace the Oracle-specific v$session example query in the
PostgreSQL template’s commented metrics block with a valid PostgreSQL query
using pg_stat_activity, preserving equivalent session status/type counts where
supported, or remove the example block entirely.

In `@public/n9e-collect-templates/tomcat.toml`:
- Around line 23-30: Update the commented insecure_skip_verify example in the
Optional TLS Config section to use false, so the template defaults to secure
certificate validation while retaining the option for an explicit true opt-out.

In `@public/n9e-collect-templates/zookeeper.toml`:
- Around line 12-19: Update the commented insecure_skip_verify example in the
Optional TLS Config section of zookeeper.toml from true to false, so the example
enables certificate validation by default while retaining the explicit opt-out
setting.

In `@scripts/sync_collect_templates.sh`:
- Around line 45-60: Make the synchronization flow in
scripts/sync_collect_templates.sh transactional: build and validate the complete
template set in a temporary staging directory, fail when no expected catalog
files are found or any copy fails, and only then replace OUT_DIR atomically. Do
not remove the existing published templates before validation succeeds; preserve
the excluded-name filtering and count reporting while ensuring failures cannot
leave a partial destination.

In `@src/pages/hosts/pages/List/CollectSetup/buildCommand.ts`:
- Around line 42-59: The collect commands expose reversible TOML credentials
through the --conf-b64 argv argument. Update buildCollectCommand and
buildManualCollectCommand, together with the corresponding script interface, to
transport the encoded configuration through an environment variable, stdin, or a
short-lived file rather than the command line, while preserving command
functionality and avoiding shell history/process-argument exposure.

In `@src/pages/hosts/pages/List/List.tsx`:
- Around line 993-1011: Expose the machines detected by InstallCategraf through
its detectedExtra handoff, preferably by providing the detected idents to the
render callback or an equivalent onDetected callback. In List.tsx, store those
idents when the install completes and pass them as CollectSetup’s defaultIdents
for the next_entry flow instead of the stale selectedIdents, while preserving
the existing close, refresh, and collect-opening behavior.

---

Nitpick comments:
In `@src/pages/hosts/pages/List/CollectSetup/useMetricArrival.ts`:
- Around line 58-64: Move the render-time assignments to datasourcesRef.current
and identsRef.current into an appropriate useEffect or useLayoutEffect in the
useMetricArrival hook. Keep datasourceKey and identsKey memoization unchanged,
and ensure the polling logic still reads the latest datasource and ident values
through the refs.