feat: system/http/traefik collectors and docker auto-discovery (M3)

Adds the remaining monitor types: a systeminformation-backed system
widget (single-flight cached so multiple widgets don't force
concurrent samples), an http widget with per-widget consecutive-
failure tracking, and a traefik widget that reads router/entrypoint/
middleware status from Traefik's own API. Also adds opt-in label-based
docker auto-discovery (discovery.docker in config.yml): containers
carrying traefik.enable=true are turned into docker widgets in a
synthetic "Discovered" group, re-scanned on a timer and whenever
config.yml changes, with manual widgets always taking precedence over
a discovered one for the same container.

Fixes a real bug surfaced while testing discovery: Next's App Router
bundles app/** through its own compiler pass, separate from server.ts
(run directly via tsx), so configStore/effectiveConfigStore were
silently instantiated twice - one instance watched and updated by
server.ts, another frozen instance read by SSR. Live config edits were
never reflected on page load without a full process restart. Both
stores now key their singleton off globalThis, which both module
graphs share within the same process.

Verified against a real Traefik v3 container (API-driven router list,
ping-based http check) and a labeled nginx container (auto-discovery),
including that a config.yml edit now shows up in a fresh page load
without restarting the server, in both dev and the production build.

lib/discovery/traefik-labels.ts

@@ -0,0 +1,64 @@
+import Docker from "dockerode";
+import type { Config, Widget } from "@/lib/config/schema";
+
+const HOST_RULE_PATTERN = /Host\(`([^`]+)`\)/;
+
+function extractHostname(labels: Record<string, string>, prefix: string): string | null {
+  for (const [key, value] of Object.entries(labels)) {
+    if (key.startsWith(`${prefix}.http.routers.`) && key.endsWith(".rule")) {
+      const match = HOST_RULE_PATTERN.exec(value);
+      if (match) return match[1];
+    }
+  }
+  return null;
+}
+
+export async function discoverDockerWidgets(config: Config): Promise<Widget[]> {
+  const settings = config.discovery.docker;
+  if (!settings.enabled) return [];
+
+  const docker = new Docker({ socketPath: settings.socketPath });
+  const containers = await docker.listContainers({ all: false });
+
+  const manualContainerNames = new Set(
+    config.groups.flatMap((group) =>
+      group.widgets
+        .filter(
+          (widget): widget is Extract<Widget, { type: "docker" | "database" }> =>
+            widget.type === "docker" || widget.type === "database"
+        )
+        .map((widget) => widget.containerName)
+    )
+  );
+
+  const prefix = settings.labelPrefix;
+  const discovered: Widget[] = [];
+
+  for (const container of containers) {
+    const labels = container.Labels ?? {};
+
+    if (labels[`${prefix}.enable`] !== "true") continue;
+    if (settings.excludeLabels.some((label) => labels[label] !== undefined)) continue;
+
+    const name = container.Names[0]?.replace(/^\//, "");
+    if (!name || manualContainerNames.has(name)) continue;
+
+    if (settings.network) {
+      const containerNetwork = labels[`${prefix}.docker.network`];
+      if (containerNetwork && containerNetwork !== settings.network) continue;
+    }
+
+    const hostname = extractHostname(labels, prefix);
+
+    discovered.push({
+      type: "docker",
+      name,
+      containerName: name,
+      href: hostname ? `https://${hostname}` : undefined,
+      showStats: true,
+      interval: "10s",
+    });
+  }
+
+  return discovered;
+}