feat: system/http/traefik collectors and docker auto-discovery (M3)

Adds the remaining monitor types: a systeminformation-backed system
widget (single-flight cached so multiple widgets don't force
concurrent samples), an http widget with per-widget consecutive-
failure tracking, and a traefik widget that reads router/entrypoint/
middleware status from Traefik's own API. Also adds opt-in label-based
docker auto-discovery (discovery.docker in config.yml): containers
carrying traefik.enable=true are turned into docker widgets in a
synthetic "Discovered" group, re-scanned on a timer and whenever
config.yml changes, with manual widgets always taking precedence over
a discovered one for the same container.

Fixes a real bug surfaced while testing discovery: Next's App Router
bundles app/** through its own compiler pass, separate from server.ts
(run directly via tsx), so configStore/effectiveConfigStore were
silently instantiated twice - one instance watched and updated by
server.ts, another frozen instance read by SSR. Live config edits were
never reflected on page load without a full process restart. Both
stores now key their singleton off globalThis, which both module
graphs share within the same process.

Verified against a real Traefik v3 container (API-driven router list,
ping-based http check) and a labeled nginx container (auto-discovery),
including that a config.yml edit now shows up in a fresh page load
without restarting the server, in both dev and the production build.

lib/collectors/traefik.ts

@@ -0,0 +1,48 @@
+import type { TraefikResult } from "@/lib/types/traefik-result";
+
+interface RawRouter {
+  name: string;
+  rule: string;
+  service: string;
+  status: string;
+  tls?: unknown;
+  entryPoints?: string[];
+}
+
+interface RawEntrypoint {
+  name: string;
+  address: string;
+}
+
+async function fetchJson<T>(url: string): Promise<T | null> {
+  const response = await fetch(url, { signal: AbortSignal.timeout(5_000) });
+  if (!response.ok) return null;
+  return (await response.json()) as T;
+}
+
+export async function collectTraefik(apiUrl: string): Promise<TraefikResult> {
+  const base = apiUrl.replace(/\/$/, "");
+
+  const [routers, entrypoints, middlewares] = await Promise.all([
+    fetchJson<RawRouter[]>(`${base}/http/routers`),
+    fetchJson<RawEntrypoint[]>(`${base}/entrypoints`),
+    fetchJson<unknown[]>(`${base}/http/middlewares`),
+  ]);
+
+  if (routers === null) {
+    throw new Error(`Traefik API at ${base}/http/routers is unreachable or returned an error`);
+  }
+
+  return {
+    routers: routers.map((router) => ({
+      name: router.name,
+      rule: router.rule,
+      service: router.service,
+      status: router.status,
+      tls: Boolean(router.tls),
+      entryPoints: router.entryPoints ?? [],
+    })),
+    entrypoints: (entrypoints ?? []).map((ep) => ({ name: ep.name, address: ep.address })),
+    middlewaresCount: middlewares?.length ?? 0,
+  };
+}