Aggregate stats for the workflow health page.

Cookie-authenticated, because the only caller is the React component the health LiveView mounts. This is its own trust boundary — the LiveView's on_mount guards do not protect it, since a client can request any path. Access to the project is re-checked here, via the same policy the rest of the app uses, so support users get in and soft-deleted projects don't.

One action per chart, so a cheap chart isn't held up by an expensive one.