fix: address network probe code quality issues

- Use shared http.Client in ProbeManager to avoid connection/transport leak
- Skip probe goroutine and agent request when system has no enabled probes
- Validate HTTP probe target URL scheme (http:// or https://) on creation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/hub/api_probes.go

@@ -3,6 +3,7 @@ package hub
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
@@ -75,6 +76,9 @@ func (h *Hub) createNetworkProbe(e *core.RequestEvent) error {
 	if req.Protocol != "icmp" && req.Protocol != "tcp" && req.Protocol != "http" {
 		return e.BadRequestError("protocol must be icmp, tcp, or http", nil)
 	}
+	if req.Protocol == "http" && !strings.HasPrefix(req.Target, "http://") && !strings.HasPrefix(req.Target, "https://") {
+		return e.BadRequestError("http probe target must start with http:// or https://", nil)
+	}
 	if req.Interval <= 0 {
 		req.Interval = 10
 	}

internal/hub/systems/system.go

@@ -169,7 +169,9 @@ func (sys *System) update() error {
 	}
 
 	// Fetch and save network probe results
-	go sys.fetchAndSaveProbeResults()
+	if sys.hasEnabledProbes() {
+		go sys.fetchAndSaveProbeResults()
+	}
 
 	return err
 }

internal/hub/systems/system_probes.go

@@ -27,17 +27,17 @@ func (sys *System) FetchNetworkProbeResults() (map[string]probe.Result, error) {
 	return results, err
 }
 
+// hasEnabledProbes returns true if this system has any enabled network probes.
+func (sys *System) hasEnabledProbes() bool {
+	count, err := sys.manager.hub.CountRecords("network_probes",
+		dbx.NewExp("system = {:system} AND enabled = true", dbx.Params{"system": sys.Id}))
+	return err == nil && count > 0
+}
+
 // fetchAndSaveProbeResults fetches probe results and saves them to the database.
 func (sys *System) fetchAndSaveProbeResults() {
 	hub := sys.manager.hub
 
-	// Check if this system has any probes
-	count, err := hub.CountRecords("network_probes",
-		dbx.NewExp("system = {:system} AND enabled = true", dbx.Params{"system": sys.Id}))
-	if err != nil || count == 0 {
-		return
-	}
-
 	results, err := sys.FetchNetworkProbeResults()
 	if err != nil || len(results) == 0 {
 		return

internal/hub/systems/system_realtime.go

@@ -168,8 +168,10 @@ func (sm *SystemManager) fetchRealtimeDataAndNotify() {
 				Containers: data.Containers,
 			}
 			// Fetch network probe results (lightweight in-memory read on agent)
-			if probes, err := sys.FetchNetworkProbeResults(); err == nil && len(probes) > 0 {
-				payload.Probes = probes
+			if sys.hasEnabledProbes() {
+				if probes, err := sys.FetchNetworkProbeResults(); err == nil && len(probes) > 0 {
+					payload.Probes = probes
+				}
 			}
 			bytes, err := json.Marshal(payload)
 			if err == nil {