feat: add combined docker+API service widgets for gitea/coolify/immich/n8n/umami/headscale

One new `service` widget type (nested discriminated union on `service`)
rather than six, so a single config entry shows both docker container
health and a service-specific stat (repo count, project list, photo
count, workflow count, active users, users/nodes) - avoiding the
overhead of configuring a docker widget and a separate service widget
per container. All six collectors hit the service's container name +
internal port directly on falcon_network, the same container-to-
container pattern just proven out for Traefik's own API, avoiding
vpn-only/hairpin-NAT entirely.

Also adds the public/private config split that was scoped in the
original project plan but never built: lib/config/public.ts strips
apiToken/apiKey/password fields before the config reaches the browser
via SSR or the WS config topic - required before any widget could
carry a real secret. Verified via a throwaway secret field that it's
absent from both the SSR HTML and the WS config:update frame.

Endpoint shapes verified live against the running gitea/coolify/immich/
n8n/umami/headscale containers before committing (unauthenticated
requests correctly 401/200 on every target route; gitea's
X-Total-Count header confirmed present).

lib/collectors/scheduler.ts

@@ -2,13 +2,13 @@ import pLimit from "p-limit";
 import type { Config, Widget } from "@/lib/config/schema";
 import { flattenWidgets } from "@/lib/config/widgets";
 import { parseDuration } from "@/lib/config/duration";
-import { collectDockerContainer } from "./docker";
+import { collectDockerContainer, dockerLimit } from "./docker";
 import { collectSystem } from "./system";
 import { collectHttp } from "./http";
 import { collectTraefik } from "./traefik";
+import { collectService } from "./service";
 import type { WidgetResult } from "@/lib/types/widget-result";
 
-const dockerLimit = pLimit(4);
 const httpLimit = pLimit(8);
 
 type ResultListener = (widgetId: string, result: WidgetResult) => void;
@@ -20,7 +20,14 @@ interface Job {
   consecutiveFailures: number;
 }
 
-const COLLECTOR_TYPES = new Set<Widget["type"]>(["docker", "database", "system", "http", "traefik"]);
+const COLLECTOR_TYPES = new Set<Widget["type"]>([
+  "docker",
+  "database",
+  "system",
+  "http",
+  "traefik",
+  "service",
+]);
 
 function isCollectorWidget(widget: Widget): boolean {
   return COLLECTOR_TYPES.has(widget.type);
@@ -32,7 +39,8 @@ function getIntervalMs(widget: Widget): number {
     widget.type === "database" ||
     widget.type === "system" ||
     widget.type === "http" ||
-    widget.type === "traefik"
+    widget.type === "traefik" ||
+    widget.type === "service"
   ) {
     return parseDuration(widget.interval);
   }
@@ -55,6 +63,9 @@ function sameTarget(a: Widget, b: Widget): boolean {
   if (a.type === "traefik" && b.type === "traefik") {
     return a.apiUrl === b.apiUrl;
   }
+  if (a.type === "service" && b.type === "service") {
+    return a.containerName === b.containerName && a.service === b.service && a.showStats === b.showStats;
+  }
   return false;
 }
 
@@ -81,6 +92,10 @@ async function collect(widget: Widget): Promise<WidgetResult> {
     const data = await collectTraefik(widget.apiUrl);
     return { type: "traefik", data };
   }
+  if (widget.type === "service") {
+    const data = await collectService(widget);
+    return { type: "service", data };
+  }
   throw new Error(`No collector for widget type "${widget.type}"`);
 }