admin dashboard, metrics and telemetry

- embedded React admin UI at /admin/ui (go:embed), login with ADMIN_SECRET
  via signed HttpOnly session cookie, X-ADMIN-KEY still works for scripts
- admin API: overview stats, indexing queue, addon management (priority,
  reindex, delete/restore/purge, bulk), whitelist CRUD, duplicate hashes,
  traffic, metrics explorer, services, events/audit log, system info
- built-in metrics: request latency per route, visitors, top addons and
  searches, indexer/scraper counters; minute buckets in the DB with hourly
  rollups and retention; optional Prometheus /metrics (METRICS_TOKEN)
- POST /back/telemetry for indexers/scrapers (metrics, events, heartbeat)
  and a stdlib-only Go client in telemetry/
- auth hardening: empty secrets no longer allow access, constant-time
  compare, CORS not applied to /admin and /back, TRUSTED_PROXIES setting
- Dockerfile builds the UI and no longer bakes config.yaml into the image;
  CI builds the UI, runs tests and builds arm64 with CGO

web/vite.config.ts

@@ -0,0 +1,22 @@
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import tailwindcss from "@tailwindcss/vite";
+
+// The build is embedded into the Go binary (web/embed.go) and served at /admin/ui/.
+// In dev, run the Go server on :8083 and `npm run dev`, then open
+// http://localhost:5173/admin/ui/
+export default defineConfig({
+  base: "/admin/ui/",
+  plugins: [react(), tailwindcss()],
+  build: {
+    outDir: "dist",
+    // keep dist/.gitkeep so go:embed always has a directory
+    emptyOutDir: false,
+    chunkSizeWarningLimit: 600,
+  },
+  server: {
+    proxy: {
+      "/admin/api": "http://localhost:8083",
+    },
+  },
+});