feat: system/http/traefik collectors and docker auto-discovery (M3)

Adds the remaining monitor types: a systeminformation-backed system
widget (single-flight cached so multiple widgets don't force
concurrent samples), an http widget with per-widget consecutive-
failure tracking, and a traefik widget that reads router/entrypoint/
middleware status from Traefik's own API. Also adds opt-in label-based
docker auto-discovery (discovery.docker in config.yml): containers
carrying traefik.enable=true are turned into docker widgets in a
synthetic "Discovered" group, re-scanned on a timer and whenever
config.yml changes, with manual widgets always taking precedence over
a discovered one for the same container.

Fixes a real bug surfaced while testing discovery: Next's App Router
bundles app/** through its own compiler pass, separate from server.ts
(run directly via tsx), so configStore/effectiveConfigStore were
silently instantiated twice - one instance watched and updated by
server.ts, another frozen instance read by SSR. Live config edits were
never reflected on page load without a full process restart. Both
stores now key their singleton off globalThis, which both module
graphs share within the same process.

Verified against a real Traefik v3 container (API-driven router list,
ping-based http check) and a labeled nginx container (auto-discovery),
including that a config.yml edit now shows up in a fresh page load
without restarting the server, in both dev and the production build.

lib/ws/server.ts

@@ -2,6 +2,7 @@ import type { Server as HttpServer } from "node:http";
 import { WebSocket, WebSocketServer } from "ws";
 import { collectorScheduler } from "@/lib/collectors/scheduler";
 import { configStore, type ConfigError } from "@/lib/config/loader";
+import { effectiveConfigStore } from "@/lib/config/effective";
 import type { Config } from "@/lib/config/schema";
 import type { WidgetResult } from "@/lib/types/widget-result";
 
@@ -47,7 +48,7 @@ export function attachWebSocketServer(httpServer: HttpServer): WebSocketServer {
     allSockets.add(socket);
 
     try {
-      const config = configStore.get();
+      const config = effectiveConfigStore.get();
       send(socket, { topic: "config", type: "config:update", ts: Date.now(), data: config });
     } catch {
       // no valid config loaded yet; client keeps its SSR-seeded config until one arrives
@@ -78,7 +79,7 @@ export function attachWebSocketServer(httpServer: HttpServer): WebSocketServer {
     for (const socket of set) send(socket, envelope);
   });
 
-  configStore.onUpdate((config) => {
+  effectiveConfigStore.onUpdate((config) => {
     const envelope: Envelope = { topic: "config", type: "config:update", ts: Date.now(), data: config };
     for (const socket of allSockets) send(socket, envelope);
   });