feat: add combined docker+API service widgets for gitea/coolify/immich/n8n/umami/headscale

One new `service` widget type (nested discriminated union on `service`)
rather than six, so a single config entry shows both docker container
health and a service-specific stat (repo count, project list, photo
count, workflow count, active users, users/nodes) - avoiding the
overhead of configuring a docker widget and a separate service widget
per container. All six collectors hit the service's container name +
internal port directly on falcon_network, the same container-to-
container pattern just proven out for Traefik's own API, avoiding
vpn-only/hairpin-NAT entirely.

Also adds the public/private config split that was scoped in the
original project plan but never built: lib/config/public.ts strips
apiToken/apiKey/password fields before the config reaches the browser
via SSR or the WS config topic - required before any widget could
carry a real secret. Verified via a throwaway secret field that it's
absent from both the SSR HTML and the WS config:update frame.

Endpoint shapes verified live against the running gitea/coolify/immich/
n8n/umami/headscale containers before committing (unauthenticated
requests correctly 401/200 on every target route; gitea's
X-Total-Count header confirmed present).

lib/config/schema.ts

@@ -65,6 +65,64 @@ export const traefikWidgetSchema = z.object({
   interval: durationSchema.default("15s"),
 });
 
+const serviceCommonFields = {
+  type: z.literal("service") as z.ZodLiteral<"service">,
+  name: z.string(),
+  containerName: z.string(),
+  href: z.string().url().optional(),
+  showStats: z.boolean().default(true),
+  interval: durationSchema.default("15s"),
+  icon: z.string().optional(),
+};
+
+export const giteaServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("gitea"),
+  username: z.string().default("Valknar"),
+  apiToken: z.string(),
+});
+
+export const coolifyServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("coolify"),
+  apiToken: z.string(),
+});
+
+export const immichServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("immich"),
+  apiKey: z.string(),
+});
+
+export const n8nServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("n8n"),
+  apiKey: z.string(),
+});
+
+export const umamiServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("umami"),
+  username: z.string(),
+  password: z.string(),
+  websiteId: z.string(),
+});
+
+export const headscaleServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("headscale"),
+  apiToken: z.string(),
+});
+
+export const serviceWidgetSchema = z.discriminatedUnion("service", [
+  giteaServiceWidgetSchema,
+  coolifyServiceWidgetSchema,
+  immichServiceWidgetSchema,
+  n8nServiceWidgetSchema,
+  umamiServiceWidgetSchema,
+  headscaleServiceWidgetSchema,
+]);
+
 export const widgetSchema = z.discriminatedUnion("type", [
   bookmarkWidgetSchema,
   searchWidgetSchema,
@@ -73,6 +131,7 @@ export const widgetSchema = z.discriminatedUnion("type", [
   systemWidgetSchema,
   httpWidgetSchema,
   traefikWidgetSchema,
+  serviceWidgetSchema,
 ]);
 
 export const groupSchema = z.object({
@@ -126,3 +185,10 @@ export type Config = z.infer<typeof configSchema>;
 export type Widget = z.infer<typeof widgetSchema>;
 export type Group = z.infer<typeof groupSchema>;
 export type SearchEngine = z.infer<typeof searchEngineSchema>;
+export type ServiceWidget = z.infer<typeof serviceWidgetSchema>;
+export type GiteaServiceWidget = z.infer<typeof giteaServiceWidgetSchema>;
+export type CoolifyServiceWidget = z.infer<typeof coolifyServiceWidgetSchema>;
+export type ImmichServiceWidget = z.infer<typeof immichServiceWidgetSchema>;
+export type N8nServiceWidget = z.infer<typeof n8nServiceWidgetSchema>;
+export type UmamiServiceWidget = z.infer<typeof umamiServiceWidgetSchema>;
+export type HeadscaleServiceWidget = z.infer<typeof headscaleServiceWidgetSchema>;