Custom Filevault/EScrow: host status derivation and summaries

## Related user story #48654 **Depends on:** #51258 ## Task Teach status derivation the four macOS combos (per the spec's status matrix) and re-key Windows/Linux summaries and host-list filters to their platform's setting. ### Per-host macOS derivation - `PopulateOSSettingsAndMacOSSettings` (`server/fleet/hosts.go:938-1013`): today derives the six statuses from (FileVault profile status/operation) × `rawDecryptable`. Extend with the fleet's macOS settings and the host's on-disk encryption state (`host_disks.encrypted`, ingested by `disk_encryption_darwin`, `queries.go:794-799`): enforce-only uses profile × disk-encrypted (no key states); escrow-only uses profile-pending then key states. Callers: `server/service/hosts.go:1885`, status override at `:1921-1926`, Linux branch `:1948-1975`. - `ProfileStatusFromDiskEncryptionState` (`hosts.go:1015-1035`) mapping stays; confirm each combo maps onto the existing six statuses (no new enum values — pending open question 1 on the UI label only). ### Summaries and filters (SQL) - The six `subqueryFileVault*` (`server/datastore/mysql/apple_mdm.go:3523-3637`) and `GetMDMAppleFileVaultSummary` (`:3637+`): parameterize on the fleet's two macOS settings (summaries are per-fleet calls — fetch `DiskEncryptionConfig` in Go, pass booleans as SQL params; no JSON_EXTRACT on `teams.config`). Enforce-only variants join `host_disks.encrypted` instead of `hdek.decryptable`; escrow-only variants keep the key conditions. - Host list filters: `filterHostsByOSSettingsDiskEncryptionStatus` (`server/datastore/mysql/hosts.go:1911-1985`) and `filterHostsByOSSettingsStatus` (`:1773-1909`); label variant at `labels.go:1412`. **Also the legacy macOS-only filters** — `filterHostsByMacOSDiskEncryptionStatus` (`hosts.go:1748-1771`) and `filterHostsByMacOSSettingsStatus` (`hosts.go:1730`), backing the still-live `macos_settings.disk_encryption` / `macos_settings` filter params (invoked at `hosts.go:1544/1548`, `labels.go:1406/1410`) — same parameterization or they silently keep key-based semantics in the new combos. Note the pre-existing asymmetry: Windows/Linux predicates collapse to FALSE when disabled, macOS relies on profile presence — after this change all platforms key off their platform's setting explicitly. - Windows: `whereBitLockerStatus`/summary/per-host (`microsoft_mdm.go:1623-1830`) — `Enabled` → `WindowsEnabled` (behavior-neutral rename). - Linux: `LinuxHostDiskEncryptionStatus` + summary (`server/service/linux_mdm.go:10-70`, SQL `server/datastore/mysql/linux_mdm.go:11-70`) — → `LinuxEscrowEnabled`. - `GetMDMDiskEncryptionSummary` (`ee/server/service/mdm.go:1385-1445`): include each platform's aggregate iff that platform's setting is on. - `sqlJoinMDMAppleProfilesStatus` (`apple_mdm.go:3298-3329`) splits `fv_*` from `prof_*` columns — verify the FileVault profile stays excluded from generic OS-settings counts in all combos (it exists in escrow-only form too). ### API surface `GET /disk_encryption` response shape and status names are unchanged (per merged doc PRs). The UI status table keeps today's labels — the mock's "Endorcing (pending)" was confirmed a typo of Enforcing; backend emits the same six statuses in every combo. ## Condition of satisfaction - [ ] Datastore matrix tests: for each macOS combo × host state (profile pending/verified/failed × key absent/undecryptable/decryptable × disk encrypted/not), per-host status and the six summary buckets match the spec matrix. `MYSQL_TEST=1 go test ./server/datastore/mysql/...` - [ ] Enforce ✓ / Escrow ✓ results byte-identical to today's expectations (regression corpus — reuse existing FileVault summary tests unchanged). - [ ] Off/off: macOS hosts excluded from disk encryption status and from OS-settings verification aggregates, matching today's toggle-off behavior. - [ ] Windows summary empty iff Windows setting off; Linux summary empty iff Linux setting off; fleet-level overrides respected. - [ ] Host list filter `os_settings_disk_encryption=<status>` returns correct hosts for each combo, macOS/Windows/Linux. - [ ] End-to-end (after 2 merges): escrow-only host goes action required → verifying → verified as key arrives and cron decrypts. `MYSQL_TEST=1 REDIS_TEST=1 go test ./server/service/...`