admin dashboard, metrics and telemetry

- embedded React admin UI at /admin/ui (go:embed), login with ADMIN_SECRET
  via signed HttpOnly session cookie, X-ADMIN-KEY still works for scripts
- admin API: overview stats, indexing queue, addon management (priority,
  reindex, delete/restore/purge, bulk), whitelist CRUD, duplicate hashes,
  traffic, metrics explorer, services, events/audit log, system info
- built-in metrics: request latency per route, visitors, top addons and
  searches, indexer/scraper counters; minute buckets in the DB with hourly
  rollups and retention; optional Prometheus /metrics (METRICS_TOKEN)
- POST /back/telemetry for indexers/scrapers (metrics, events, heartbeat)
  and a stdlib-only Go client in telemetry/
- auth hardening: empty secrets no longer allow access, constant-time
  compare, CORS not applied to /admin and /back, TRUSTED_PROXIES setting
- Dockerfile builds the UI and no longer bakes config.yaml into the image;
  CI builds the UI, runs tests and builds arm64 with CGO

controllers/authController.go

@@ -1,26 +1,16 @@
 package controllers
 
 import (
-	"net/http"
-
-	"gitea.tbdevent.eu/TBD/reforger_crawler_main/initializers"
+	"gitea.tbdevent.eu/TBD/reforger_crawler_main/auth"
 	"github.com/gin-gonic/gin"
 )
 
+// CheckAllowed guards the scraper/indexer endpoints (X-SECRET-KEY).
 func CheckAllowed(c *gin.Context) {
-	secret := c.GetHeader("X-SECRET-KEY")
-	if secret != initializers.SecretKey {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Forbidden"})
-		c.Abort()
-		return
-	}
+	auth.RequireSecret(c)
 }
 
+// CheckAdmin is the legacy header-only admin check (X-ADMIN-KEY).
 func CheckAdmin(c *gin.Context) {
-	adminSecret := c.GetHeader("X-ADMIN-KEY")
-	if adminSecret != initializers.AdminSecret {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Forbidden"})
-		c.Abort()
-		return
-	}
+	auth.RequireAdminHeader(c)
 }