Initial Meterbox commit with boot disk usage metric.

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/rules/docker-always-localhost.mdc

@@ -0,0 +1,13 @@
+---
+description: Meterbox always runs via Docker with localhost-only exposure
+alwaysApply: true
+---
+
+# Meterbox runtime
+
+- **Always Dockerize** Meterbox. Do not run the native binary as the supported deploy path.
+- **Localhost only.** Never publish as `8787:8787` or `0.0.0.0:8787`.
+- Preferred compose mode: `network_mode: host` with `METERBOX_LISTEN=127.0.0.1:8787` (no Docker port publish, no DNAT bypass).
+- If bridge networking is used instead, publish only `127.0.0.1:8787:8787`.
+- After Docker changes: `sudo iptables -L -n -v` and confirm `DOCKER*` chains coexist with the Oracle firewall.
+- Caddy/Rathole proxy to `127.0.0.1:8787`; Internet clients must not reach the container directly.