feat: system/http/traefik collectors and docker auto-discovery (M3)

Adds the remaining monitor types: a systeminformation-backed system
widget (single-flight cached so multiple widgets don't force
concurrent samples), an http widget with per-widget consecutive-
failure tracking, and a traefik widget that reads router/entrypoint/
middleware status from Traefik's own API. Also adds opt-in label-based
docker auto-discovery (discovery.docker in config.yml): containers
carrying traefik.enable=true are turned into docker widgets in a
synthetic "Discovered" group, re-scanned on a timer and whenever
config.yml changes, with manual widgets always taking precedence over
a discovered one for the same container.

Fixes a real bug surfaced while testing discovery: Next's App Router
bundles app/** through its own compiler pass, separate from server.ts
(run directly via tsx), so configStore/effectiveConfigStore were
silently instantiated twice - one instance watched and updated by
server.ts, another frozen instance read by SSR. Live config edits were
never reflected on page load without a full process restart. Both
stores now key their singleton off globalThis, which both module
graphs share within the same process.

Verified against a real Traefik v3 container (API-driven router list,
ping-based http check) and a labeled nginx container (auto-discovery),
including that a config.yml edit now shows up in a fresh page load
without restarting the server, in both dev and the production build.

lib/config/schema.ts

@@ -36,11 +36,41 @@ export const databaseWidgetSchema = z.object({
   interval: durationSchema.default("10s"),
 });
 
+export const systemWidgetSchema = z.object({
+  type: z.literal("system"),
+  name: z.string().default("System"),
+  interval: durationSchema.default("5s"),
+});
+
+export const httpWidgetSchema = z.object({
+  type: z.literal("http"),
+  name: z.string(),
+  url: z.string().url(),
+  method: z.enum(["GET", "HEAD", "POST"]).default("GET"),
+  timeout: durationSchema.default("5s"),
+  interval: durationSchema.default("30s"),
+  expect: z
+    .object({
+      status: z.number().int().min(100).max(599).default(200),
+    })
+    .default({ status: 200 }),
+});
+
+export const traefikWidgetSchema = z.object({
+  type: z.literal("traefik"),
+  name: z.string().default("Traefik"),
+  apiUrl: z.string().url(),
+  interval: durationSchema.default("15s"),
+});
+
 export const widgetSchema = z.discriminatedUnion("type", [
   bookmarkWidgetSchema,
   searchWidgetSchema,
   dockerWidgetSchema,
   databaseWidgetSchema,
+  systemWidgetSchema,
+  httpWidgetSchema,
+  traefikWidgetSchema,
 ]);
 
 export const groupSchema = z.object({
@@ -62,9 +92,31 @@ export const settingsSchema = z
   })
   .default({ title: "PulseNode" });
 
+const dockerDiscoveryDefaults = {
+  enabled: false,
+  socketPath: "/var/run/docker.sock",
+  labelPrefix: "traefik",
+  excludeLabels: [] as string[],
+};
+
+const dockerDiscoverySchema = z.object({
+  enabled: z.boolean().default(false),
+  socketPath: z.string().default("/var/run/docker.sock"),
+  labelPrefix: z.string().default("traefik"),
+  network: z.string().optional(),
+  excludeLabels: z.array(z.string()).default([]),
+});
+
+export const discoverySchema = z
+  .object({
+    docker: dockerDiscoverySchema.default(dockerDiscoveryDefaults),
+  })
+  .default({ docker: dockerDiscoveryDefaults });
+
 export const configSchema = z.object({
   theme: themeSchema,
   settings: settingsSchema,
+  discovery: discoverySchema,
   groups: z.array(groupSchema).default([]),
 });