admin dashboard, metrics and telemetry

- embedded React admin UI at /admin/ui (go:embed), login with ADMIN_SECRET
  via signed HttpOnly session cookie, X-ADMIN-KEY still works for scripts
- admin API: overview stats, indexing queue, addon management (priority,
  reindex, delete/restore/purge, bulk), whitelist CRUD, duplicate hashes,
  traffic, metrics explorer, services, events/audit log, system info
- built-in metrics: request latency per route, visitors, top addons and
  searches, indexer/scraper counters; minute buckets in the DB with hourly
  rollups and retention; optional Prometheus /metrics (METRICS_TOKEN)
- POST /back/telemetry for indexers/scrapers (metrics, events, heartbeat)
  and a stdlib-only Go client in telemetry/
- auth hardening: empty secrets no longer allow access, constant-time
  compare, CORS not applied to /admin and /back, TRUSTED_PROXIES setting
- Dockerfile builds the UI and no longer bakes config.yaml into the image;
  CI builds the UI, runs tests and builds arm64 with CGO

controllers/feController.go

@@ -6,6 +6,7 @@ import (
 	"strconv"
 
 	"gitea.tbdevent.eu/TBD/reforger_crawler_main/initializers"
+	"gitea.tbdevent.eu/TBD/reforger_crawler_main/metrics"
 	"gitea.tbdevent.eu/TBD/reforger_crawler_main/models"
 	"github.com/gin-gonic/gin"
 )
@@ -114,6 +115,7 @@ func GetDuplicates(c *gin.Context) {
 	for _, file := range duplicateFiles {
 		duplicatesByAddonID[file.AddonID] = append(duplicatesByAddonID[file.AddonID], file)
 	}
+	metrics.DuplicatesFound.Observe(float64(len(duplicatesByAddonID)))
 
 	// Fetch addon information for each addon that has duplicates
 	var addonIDs []string