fix: seven fixes — token scan, variadic cleanup, TUI layout, compose secrets

1. UpdateSite handles token-read Scan error instead of ignoring it.
   sql.ErrNoRows (nonexistent site) passes through; real DB errors
   surface.

2. RunCheck allowPrivate changed from variadic to real bool param.
   Dead maxRequestBody duplicate removed from sqlstore.go.

3. Footer help bar documents [Space] for group collapse.

4. adjustCursor unified with clampCursor — one clamping path
   instead of two with different semantics.

5. Compose cluster/probe example files annotate hardcoded secrets
   with "EXAMPLE ONLY — rotate before use".

6. huhForm.WithHeight moved from View() to handleResize — no longer
   mutates form state during render.

7. maxTableRows recalculated on filter enter/exit via recalcLayout()
   — was only recalculated on resize, causing off-by-one when the
   filter bar appeared/disappeared.

internal/monitor/checker_test.go

@@ -20,7 +20,7 @@ func TestRunCheck_HTTP_Success(t *testing.T) {
 	defer srv.Close()
 
 	site := models.SiteConfig{ID: 1, Type: "http", URL: srv.URL}
-	result := RunCheck(context.Background(), site, http.DefaultClient, http.DefaultClient, false)
+	result := RunCheck(context.Background(), site, http.DefaultClient, http.DefaultClient, false, false)
 
 	if result.Status != "UP" {
 		t.Errorf("expected UP, got %s", result.Status)
@@ -40,7 +40,7 @@ func TestRunCheck_HTTP_ServerError(t *testing.T) {
 	defer srv.Close()
 
 	site := models.SiteConfig{ID: 1, Type: "http", URL: srv.URL}
-	result := RunCheck(context.Background(), site, http.DefaultClient, http.DefaultClient, false)
+	result := RunCheck(context.Background(), site, http.DefaultClient, http.DefaultClient, false, false)
 
 	if result.Status != "DOWN" {
 		t.Errorf("expected DOWN, got %s", result.Status)
@@ -61,7 +61,7 @@ func TestRunCheck_HTTP_CustomAcceptedCodes(t *testing.T) {
 	}}
 
 	site := models.SiteConfig{ID: 1, Type: "http", URL: srv.URL, AcceptedCodes: "200-399"}
-	result := RunCheck(context.Background(), site, client, client, false)
+	result := RunCheck(context.Background(), site, client, client, false, false)
 
 	if result.Status != "UP" {
 		t.Errorf("expected UP with accepted 200-399, got %s", result.Status)
@@ -77,7 +77,7 @@ func TestRunCheck_HTTP_MethodRespected(t *testing.T) {
 	defer srv.Close()
 
 	site := models.SiteConfig{ID: 1, Type: "http", URL: srv.URL, Method: "HEAD"}
-	RunCheck(context.Background(), site, http.DefaultClient, http.DefaultClient, false)
+	RunCheck(context.Background(), site, http.DefaultClient, http.DefaultClient, false, false)
 
 	if receivedMethod != "HEAD" {
 		t.Errorf("expected HEAD, got %s", receivedMethod)
@@ -92,7 +92,7 @@ func TestRunCheck_HTTP_Timeout(t *testing.T) {
 	defer srv.Close()
 
 	site := models.SiteConfig{ID: 1, Type: "http", URL: srv.URL, Timeout: 1}
-	result := RunCheck(context.Background(), site, http.DefaultClient, http.DefaultClient, false)
+	result := RunCheck(context.Background(), site, http.DefaultClient, http.DefaultClient, false, false)
 
 	if result.Status != "DOWN" {
 		t.Errorf("expected DOWN on timeout, got %s", result.Status)
@@ -110,7 +110,7 @@ func TestRunCheck_HTTP_SSLFields(t *testing.T) {
 	}
 
 	site := models.SiteConfig{ID: 1, Type: "http", URL: srv.URL, CheckSSL: true, IgnoreTLS: true}
-	result := RunCheck(context.Background(), site, http.DefaultClient, insecureClient, false)
+	result := RunCheck(context.Background(), site, http.DefaultClient, insecureClient, false, false)
 
 	if result.Status != "UP" {
 		t.Errorf("expected UP, got %s", result.Status)
@@ -172,7 +172,7 @@ func TestRunCheck_Port_BlocksPrivateByDefault(t *testing.T) {
 	port, _ := strconv.Atoi(portStr)
 
 	site := models.SiteConfig{ID: 1, Type: "port", Hostname: "127.0.0.1", Port: port, Timeout: 2}
-	result := RunCheck(context.Background(), site, nil, nil, false)
+	result := RunCheck(context.Background(), site, nil, nil, false, false)
 
 	if result.Status != "DOWN" {
 		t.Errorf("expected DOWN when private targets blocked, got %s", result.Status)
@@ -181,7 +181,7 @@ func TestRunCheck_Port_BlocksPrivateByDefault(t *testing.T) {
 
 func TestRunCheck_UnknownType(t *testing.T) {
 	site := models.SiteConfig{ID: 1, Type: "invalid"}
-	result := RunCheck(context.Background(), site, nil, nil, false)
+	result := RunCheck(context.Background(), site, nil, nil, false, false)
 
 	if result.Status != "DOWN" {
 		t.Errorf("expected DOWN for unknown type, got %s", result.Status)