feat(iso): auto-queue an Audit task once bee-web is up

Adds bee-autoaudit.service: after the boot-time bee-web/bee-audit/
bee-preflight/bee-network units settle, it waits for bee-web to answer
/healthz and then POSTs to the same /api/audit/run endpoint the "Run Audit"
button uses. An operator opening the web UI right after boot now finds a
completed Audit task (report + charts) waiting instead of an empty task
history. Best-effort: any failure just falls back to the manual button.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot

@@ -30,6 +30,7 @@ systemctl enable bee-network.service
 systemctl enable bee-preflight.service
 systemctl enable bee-audit.service
 systemctl enable bee-web.service
+systemctl enable bee-autoaudit.service
 systemctl enable bee-sshsetup.service
 systemctl enable bee-blackbox.service
 systemctl enable bee-selfheal.timer
@@ -65,6 +66,7 @@ chmod +x /usr/local/bin/bee-smoketest  2>/dev/null || true
 chmod +x /usr/local/bin/bee            2>/dev/null || true
 chmod +x /usr/local/bin/bee-log-run    2>/dev/null || true
 chmod +x /usr/local/bin/bee-selfheal        2>/dev/null || true
+chmod +x /usr/local/bin/bee-autoaudit       2>/dev/null || true
 chmod +x /usr/local/bin/bee-boot-status    2>/dev/null || true
 chmod +x /usr/local/bin/bee-install        2>/dev/null || true
 chmod +x /usr/local/bin/bee-gui-gate       2>/dev/null || true

iso/overlay/etc/systemd/system/bee-autoaudit.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Bee: automatically queue an Audit task once the web UI is up
+After=bee-web.service bee-audit.service bee-preflight.service bee-network.service
+StartLimitIntervalSec=0
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/bee-log-run /appdata/bee/export/bee-autoaudit.log /usr/local/bin/bee-autoaudit
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

iso/overlay/usr/local/bin/bee-autoaudit

@@ -0,0 +1,43 @@
+#!/bin/bash
+# bee-autoaudit — once bee-web is actually serving, queue one Audit task
+# through the same task queue the "Run Audit" button in the UI uses. Without
+# this, an operator who opens the web UI right after boot sees an empty task
+# history and has to trigger Audit by hand; this makes that the default so
+# there's already a completed run (with its report/charts) waiting for them.
+#
+# Runs once per boot (see bee-autoaudit.service, After=bee-web.service +
+# the boot-time bee-audit/preflight/network units). Deliberately best-effort:
+# any failure here just means the operator falls back to the manual button,
+# so every exit path is 0 and failures only go to the log.
+
+set -u
+
+LOG_PREFIX="bee-autoaudit"
+WEB_TIMEOUT_SECS=120
+
+log() {
+    echo "[${LOG_PREFIX}] $*"
+}
+
+web_healthy() {
+    bash -c 'exec 3<>/dev/tcp/127.0.0.1/80 && printf "GET /healthz HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3 && grep -q "^ok$" <&3' \
+        >/dev/null 2>&1
+}
+
+elapsed=0
+until web_healthy; do
+    if [ "$elapsed" -ge "$WEB_TIMEOUT_SECS" ]; then
+        log "WARN: bee-web did not become healthy within ${WEB_TIMEOUT_SECS}s, giving up"
+        exit 0
+    fi
+    sleep 2
+    elapsed=$((elapsed + 2))
+done
+
+response=$(curl -sf -X POST http://127.0.0.1/api/audit/run 2>&1)
+rc=$?
+if [ "$rc" -ne 0 ]; then
+    log "WARN: failed to queue Audit task (curl exit $rc): $response"
+    exit 0
+fi
+log "queued Audit task: $response"