admin dashboard, metrics and telemetry

- embedded React admin UI at /admin/ui (go:embed), login with ADMIN_SECRET
  via signed HttpOnly session cookie, X-ADMIN-KEY still works for scripts
- admin API: overview stats, indexing queue, addon management (priority,
  reindex, delete/restore/purge, bulk), whitelist CRUD, duplicate hashes,
  traffic, metrics explorer, services, events/audit log, system info
- built-in metrics: request latency per route, visitors, top addons and
  searches, indexer/scraper counters; minute buckets in the DB with hourly
  rollups and retention; optional Prometheus /metrics (METRICS_TOKEN)
- POST /back/telemetry for indexers/scrapers (metrics, events, heartbeat)
  and a stdlib-only Go client in telemetry/
- auth hardening: empty secrets no longer allow access, constant-time
  compare, CORS not applied to /admin and /back, TRUSTED_PROXIES setting
- Dockerfile builds the UI and no longer bakes config.yaml into the image;
  CI builds the UI, runs tests and builds arm64 with CGO

.gitea/workflows/build.yaml

@@ -13,18 +13,40 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v4
 
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      # The admin dashboard is embedded into the binary, so build it first
+      - name: Build admin UI
+        run: |
+          npm ci --prefix web
+          npm run build --prefix web
+
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.23'
+          go-version: '1.25'
+
+      - name: Vet and test
+        run: |
+          go vet ./...
+          go test ./...
+
+      # SQLite needs CGO, so cross-compile ARM64 with the aarch64 C toolchain
+      - name: Install ARM64 C toolchain
+        run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu
 
       # Build ARM64
       - name: Build ARM64
-        run: GOOS=linux GOARCH=arm64 go build -v -o crawler_main-linux-arm64 .
+        run: CGO_ENABLED=1 CC=aarch64-linux-gnu-gcc GOOS=linux GOARCH=arm64 go build -v -ldflags "-s -w -X main.buildCommit=${{ github.sha }}" -o crawler_main-linux-arm64 .
 
       # Build AMD64
       - name: Build AMD64
-        run: GOOS=linux GOARCH=amd64 go build -v -o crawler_main-linux-amd64 .
+        run: CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -v -ldflags "-s -w -X main.buildCommit=${{ github.sha }}" -o crawler_main-linux-amd64 .
 
       # Create organized archives for download
       - name: Bundle Artifacts
@@ -52,4 +74,4 @@ jobs:
         with:
           name: linux-amd64
           path: release-amd64.tar.gz
-          if-no-files-found: error
+          if-no-files-found: error