feat: system/http/traefik collectors and docker auto-discovery (M3)

Adds the remaining monitor types: a systeminformation-backed system
widget (single-flight cached so multiple widgets don't force
concurrent samples), an http widget with per-widget consecutive-
failure tracking, and a traefik widget that reads router/entrypoint/
middleware status from Traefik's own API. Also adds opt-in label-based
docker auto-discovery (discovery.docker in config.yml): containers
carrying traefik.enable=true are turned into docker widgets in a
synthetic "Discovered" group, re-scanned on a timer and whenever
config.yml changes, with manual widgets always taking precedence over
a discovered one for the same container.

Fixes a real bug surfaced while testing discovery: Next's App Router
bundles app/** through its own compiler pass, separate from server.ts
(run directly via tsx), so configStore/effectiveConfigStore were
silently instantiated twice - one instance watched and updated by
server.ts, another frozen instance read by SSR. Live config edits were
never reflected on page load without a full process restart. Both
stores now key their singleton off globalThis, which both module
graphs share within the same process.

Verified against a real Traefik v3 container (API-driven router list,
ping-based http check) and a labeled nginx container (auto-discovery),
including that a config.yml edit now shows up in a fresh page load
without restarting the server, in both dev and the production build.

lib/config/effective.ts

@@ -0,0 +1,77 @@
+import { configStore } from "./loader";
+import { discoverDockerWidgets } from "@/lib/discovery/traefik-labels";
+import type { Config, Widget } from "./schema";
+
+const DISCOVERY_INTERVAL_MS = 60_000;
+
+type Listener = (config: Config) => void;
+
+function mergeDiscovered(config: Config, discovered: Widget[]): Config {
+  if (discovered.length === 0) return config;
+  return { ...config, groups: [...config.groups, { name: "Discovered", widgets: discovered }] };
+}
+
+function discoveredKey(widget: Widget): string {
+  return widget.type === "docker" || widget.type === "database" ? widget.containerName : "";
+}
+
+function sameDiscoveredSet(a: Widget[], b: Widget[]): boolean {
+  if (a.length !== b.length) return false;
+  const setA = new Set(a.map(discoveredKey));
+  return b.every((widget) => setA.has(discoveredKey(widget)));
+}
+
+class EffectiveConfigStore {
+  private discovered: Widget[] = [];
+  private timer: ReturnType<typeof setInterval> | null = null;
+  private readonly listeners = new Set<Listener>();
+
+  get(): Config {
+    return mergeDiscovered(configStore.get(), this.discovered);
+  }
+
+  onUpdate(listener: Listener): () => void {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+
+  async start(): Promise<void> {
+    configStore.onUpdate(() => {
+      this.emit();
+      void this.scan();
+    });
+    await this.scan();
+    this.timer = setInterval(() => void this.scan(), DISCOVERY_INTERVAL_MS);
+  }
+
+  stop(): void {
+    if (this.timer) clearInterval(this.timer);
+    this.timer = null;
+  }
+
+  private async scan(): Promise<void> {
+    try {
+      const next = await discoverDockerWidgets(configStore.get());
+      if (!sameDiscoveredSet(this.discovered, next)) {
+        this.discovered = next;
+        this.emit();
+      }
+    } catch (err) {
+      console.error(`[discovery] ${(err as Error).message}`);
+    }
+  }
+
+  private emit(): void {
+    const effective = this.get();
+    for (const listener of this.listeners) listener(effective);
+  }
+}
+
+// See lib/config/loader.ts for why this is keyed off globalThis rather than
+// exported as a plain module singleton.
+declare global {
+  var __pulsenodeEffectiveConfigStore: EffectiveConfigStore | undefined;
+}
+
+export const effectiveConfigStore = globalThis.__pulsenodeEffectiveConfigStore ?? new EffectiveConfigStore();
+globalThis.__pulsenodeEffectiveConfigStore = effectiveConfigStore;

lib/config/loader.ts

@@ -106,4 +106,15 @@ class ConfigStore {
   }
 }
 
-export const configStore = new ConfigStore();
+// Next.js bundles app/** through its own compiler pass, giving it a module
+// registry separate from server.ts (loaded directly via tsx). A plain module
+// singleton would end up duplicated - one instance watched by server.ts,
+// another frozen instance used by SSR. Both still share the same Node
+// process/heap, so keying off globalThis gives every module graph the same
+// instance.
+declare global {
+  var __pulsenodeConfigStore: ConfigStore | undefined;
+}
+
+export const configStore = globalThis.__pulsenodeConfigStore ?? new ConfigStore();
+globalThis.__pulsenodeConfigStore = configStore;

lib/config/schema.ts

@@ -36,11 +36,41 @@ export const databaseWidgetSchema = z.object({
   interval: durationSchema.default("10s"),
 });
 
+export const systemWidgetSchema = z.object({
+  type: z.literal("system"),
+  name: z.string().default("System"),
+  interval: durationSchema.default("5s"),
+});
+
+export const httpWidgetSchema = z.object({
+  type: z.literal("http"),
+  name: z.string(),
+  url: z.string().url(),
+  method: z.enum(["GET", "HEAD", "POST"]).default("GET"),
+  timeout: durationSchema.default("5s"),
+  interval: durationSchema.default("30s"),
+  expect: z
+    .object({
+      status: z.number().int().min(100).max(599).default(200),
+    })
+    .default({ status: 200 }),
+});
+
+export const traefikWidgetSchema = z.object({
+  type: z.literal("traefik"),
+  name: z.string().default("Traefik"),
+  apiUrl: z.string().url(),
+  interval: durationSchema.default("15s"),
+});
+
 export const widgetSchema = z.discriminatedUnion("type", [
   bookmarkWidgetSchema,
   searchWidgetSchema,
   dockerWidgetSchema,
   databaseWidgetSchema,
+  systemWidgetSchema,
+  httpWidgetSchema,
+  traefikWidgetSchema,
 ]);
 
 export const groupSchema = z.object({
@@ -62,9 +92,31 @@ export const settingsSchema = z
   })
   .default({ title: "PulseNode" });
 
+const dockerDiscoveryDefaults = {
+  enabled: false,
+  socketPath: "/var/run/docker.sock",
+  labelPrefix: "traefik",
+  excludeLabels: [] as string[],
+};
+
+const dockerDiscoverySchema = z.object({
+  enabled: z.boolean().default(false),
+  socketPath: z.string().default("/var/run/docker.sock"),
+  labelPrefix: z.string().default("traefik"),
+  network: z.string().optional(),
+  excludeLabels: z.array(z.string()).default([]),
+});
+
+export const discoverySchema = z
+  .object({
+    docker: dockerDiscoverySchema.default(dockerDiscoveryDefaults),
+  })
+  .default({ docker: dockerDiscoveryDefaults });
+
 export const configSchema = z.object({
   theme: themeSchema,
   settings: settingsSchema,
+  discovery: discoverySchema,
   groups: z.array(groupSchema).default([]),
 });