admin dashboard, metrics and telemetry

- embedded React admin UI at /admin/ui (go:embed), login with ADMIN_SECRET
  via signed HttpOnly session cookie, X-ADMIN-KEY still works for scripts
- admin API: overview stats, indexing queue, addon management (priority,
  reindex, delete/restore/purge, bulk), whitelist CRUD, duplicate hashes,
  traffic, metrics explorer, services, events/audit log, system info
- built-in metrics: request latency per route, visitors, top addons and
  searches, indexer/scraper counters; minute buckets in the DB with hourly
  rollups and retention; optional Prometheus /metrics (METRICS_TOKEN)
- POST /back/telemetry for indexers/scrapers (metrics, events, heartbeat)
  and a stdlib-only Go client in telemetry/
- auth hardening: empty secrets no longer allow access, constant-time
  compare, CORS not applied to /admin and /back, TRUSTED_PROXIES setting
- Dockerfile builds the UI and no longer bakes config.yaml into the image;
  CI builds the UI, runs tests and builds arm64 with CGO

.env.dokploy.example

@@ -26,3 +26,26 @@ POSTGRES_USER=postgres
 POSTGRES_PASSWORD=change-me-password
 POSTGRES_DB_NAME=dev
 POSTGRES_SSLMODE=disable
+
+# --- Admin dashboard (/admin/ui/) ---------------------------------------------
+# Log in with ADMIN_SECRET (use 16+ random characters). Rotating it signs
+# everyone out. The X-ADMIN-KEY header keeps working for scripts.
+ADMIN_SESSION_TTL_HOURS=168
+# auto = Secure cookie when the request arrived over HTTPS (X-Forwarded-Proto)
+ADMIN_COOKIE_SECURE=auto
+# Proxies whose X-Forwarded-For is trusted (comma separated IPs/CIDRs), e.g. the
+# Traefik network. Without it, client IPs (visitor counts, login throttling)
+# can be spoofed.
+TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12
+
+# --- Metrics & telemetry ---------------------------------------------------------
+METRICS_ENABLED=true
+# Enables GET /metrics (Prometheus) with "Authorization: Bearer <token>".
+# Leave empty to disable the endpoint.
+METRICS_TOKEN=
+METRICS_MINUTE_RETENTION_DAYS=7
+METRICS_HOUR_RETENTION_DAYS=180
+EVENTS_RETENTION_DAYS=30
+TOP_ITEMS_RETENTION_DAYS=90
+# Indexing claims older than this go back to the queue
+INDEX_TIMEOUT_MINUTES=30