Add Solr write-health checks (closed IndexWriter / NFS EIO)

[Robbie1977]

Summary

Adds Solr write-health checks that catch the failure mode behind the 2026-06-08 vfb_json outage: a closed Lucene IndexWriter (an EIO on write.lock when the soft NFSv3 mount backing /var/solr dropped) turned every /update into an HTTP 500 while /select and /admin/system kept returning 200. The liveness probe is a /select, so the status page stayed green throughout.

What changed

Two detectors now run against every core in solr_services (public ontology, ServerONLY, Query/vfb_json, Preview/vfb_json):

• Passive, read-only (on by default). Flags a write outage when the UPDATE./update.serverErrors.count counter (5xx only — client 4xx can't trip it) rises between checks. The baseline is taken from history before the new row is written, so a post-restart counter reset reads as a negative delta and never false-alarms. No writes against prod.
• Active, opt-in (write_probe: true per service). Issues an empty commit — the only request that reliably forces IndexWriter.ensureOpen() — so it detects a closed writer even with no other traffic. An empty commit changes no documents, but it is a write request, so it is off by default.

A container failing writes is marked not-ok (counts against uptime, shows in the cluster-degraded table) and the Solr card shows a writes failing badge. Adds the solr_history.u_server_errors column (migrated via the existing ADD COLUMN path) and exposes u_server_errors / write_ok / write_detail on /api/solr.

Testing

• Live parse against prod Solr (u_server_errors populates; active probe correctly off).
• Active probe against a mocked closed-writer 500 (flags) and a healthy 200 (passes).
• Passive delta logic: flag on rise, no flag when steady, no false alarm on post-restart reset, no flag on first sighting.
• Column migration on a pre-0.12.0 database.