admin dashboard, metrics and telemetry

- embedded React admin UI at /admin/ui (go:embed), login with ADMIN_SECRET
  via signed HttpOnly session cookie, X-ADMIN-KEY still works for scripts
- admin API: overview stats, indexing queue, addon management (priority,
  reindex, delete/restore/purge, bulk), whitelist CRUD, duplicate hashes,
  traffic, metrics explorer, services, events/audit log, system info
- built-in metrics: request latency per route, visitors, top addons and
  searches, indexer/scraper counters; minute buckets in the DB with hourly
  rollups and retention; optional Prometheus /metrics (METRICS_TOKEN)
- POST /back/telemetry for indexers/scrapers (metrics, events, heartbeat)
  and a stdlib-only Go client in telemetry/
- auth hardening: empty secrets no longer allow access, constant-time
  compare, CORS not applied to /admin and /back, TRUSTED_PROXIES setting
- Dockerfile builds the UI and no longer bakes config.yaml into the image;
  CI builds the UI, runs tests and builds arm64 with CGO

admin/routes.go

@@ -0,0 +1,57 @@
+package admin
+
+import (
+	"context"
+
+	"gitea.tbdevent.eu/TBD/reforger_crawler_main/auth"
+	"github.com/gin-gonic/gin"
+)
+
+// Register mounts the admin JSON API under /admin/api and the legacy
+// header-authenticated /admin/addWhitelistedHash endpoint.
+func Register(r *gin.Engine) {
+	r.POST("/admin/addWhitelistedHash", auth.RequireAdminHeader, legacyAddWhitelistedHash)
+
+	api := r.Group("/admin/api")
+	api.POST("/auth/login", login)
+	api.POST("/auth/logout", logout)
+
+	p := api.Group("", auth.RequireAdmin)
+	p.GET("/auth/me", me)
+
+	p.GET("/overview", overview)
+	p.GET("/overview/duplicates", duplicateHashes)
+
+	p.GET("/queue", queue)
+	p.POST("/queue/reset-stuck", resetStuck)
+
+	p.GET("/addons", listAddons)
+	p.GET("/addons/:id", addonDetail)
+	p.GET("/addons/:id/files", addonFiles)
+	p.POST("/addons/:id/:action", addonAction)
+	p.DELETE("/addons/:id", deleteAddon)
+	p.DELETE("/addons/:id/purge", purgeAddon)
+	p.POST("/bulk/addons", bulkAddons)
+
+	p.GET("/whitelist", listWhitelist)
+	p.POST("/whitelist", addWhitelist)
+	p.DELETE("/whitelist/:id", deleteWhitelist)
+	p.GET("/hashes/:hash", hashUsage)
+
+	p.GET("/metrics/catalog", metricsCatalog)
+	p.GET("/metrics/query", metricsQuery)
+	p.GET("/traffic", traffic)
+	p.GET("/top", topItems)
+
+	p.GET("/services", listServices)
+	p.GET("/services/events", listEvents)
+	p.DELETE("/services/:id", deleteService)
+
+	p.GET("/system", system)
+	p.POST("/system/maintenance", maintenance)
+}
+
+// StartBackground runs the periodic heavy statistics job.
+func StartBackground(ctx context.Context) {
+	go heavyStatsLoop(ctx)
+}