feat: delete host from UI with events and problems cleanup

DELETE /api/v1/hosts/{id} (JWT); host reappears on next agent ingest

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_hosts.py

@@ -1,8 +1,9 @@
 """Hosts list API."""
 
+import uuid
 from datetime import datetime, timezone
 
-from app.models import Host
+from app.models import Event, Host, Problem
 
 
 def test_hosts_search_by_display_name(client, db_session, jwt_headers):
@@ -24,3 +25,67 @@ def test_hosts_search_by_display_name(client, db_session, jwt_headers):
 
     r2 = client.get("/api/v1/hosts?hostname=nomatch", headers=jwt_headers)
     assert r2.json()["total"] == 0
+
+
+def test_delete_host_removes_events_and_problems(client, db_session, jwt_headers):
+    h = Host(
+        hostname="test-host",
+        os_family="linux",
+        product="ssh-monitor",
+        last_seen_at=datetime.now(timezone.utc),
+    )
+    db_session.add(h)
+    db_session.flush()
+    ev = Event(
+        event_id=str(uuid.uuid4()),
+        host_id=h.id,
+        occurred_at=datetime.now(timezone.utc),
+        category="agent",
+        type="agent.test",
+        severity="info",
+        title="t",
+        summary="s",
+        payload={},
+    )
+    db_session.add(ev)
+    db_session.add(
+        Problem(
+            host_id=h.id,
+            title="p",
+            summary="s",
+            severity="warning",
+            status="open",
+            rule_id="rule:test",
+            fingerprint="fp-del-host",
+            event_count=1,
+            last_seen_at=datetime.now(timezone.utc),
+        )
+    )
+    db_session.commit()
+
+    r = client.delete(f"/api/v1/hosts/{h.id}", headers=jwt_headers)
+    assert r.status_code == 200
+    body = r.json()
+    assert body["hostname"] == "test-host"
+    assert body["deleted_events"] == 1
+    assert body["deleted_problems"] == 1
+    assert db_session.get(Host, h.id) is None
+
+
+def test_delete_host_404(client, jwt_headers):
+    r = client.delete("/api/v1/hosts/999999", headers=jwt_headers)
+    assert r.status_code == 404
+
+
+def test_delete_host_requires_jwt(client, db_session):
+    h = Host(
+        hostname="no-auth",
+        os_family="linux",
+        product="ssh-monitor",
+        last_seen_at=datetime.now(timezone.utc),
+    )
+    db_session.add(h)
+    db_session.commit()
+    r = client.delete(f"/api/v1/hosts/{h.id}")
+    assert r.status_code == 401
+