Complete production-ready BufferDash v1

[1337lean]

Summary

Completes the production-focused BufferDash v1 pass before the first deployment.

Analytics and privacy

• adds 24-hour, 7-day, 30-day, and 90-day ranges
• adds bounce rate, sessions, browser, OS, device, country, and city breakdowns
• adds live visitor auto-refresh
• strips query strings and fragments from tracked URLs by default
• adds trusted proxy GeoIP and optional cached IPinfo enrichment
• bounds public request bodies and nested event metadata

Security and operations

• records failed logins, rate limits, unknown paths, and scanner-style paths
• restores the authenticated database-backed event stream
• adds optional bearer-authenticated host/Fail2Ban event ingestion
• adds a dedicated background worker for retention and runtime metrics
• adds Docker health checks for both the app and worker
• exposes runtime network RX/TX while retaining the container-observability warning

Deployment and maintenance

• improves Docker Compose configurability while keeping the app localhost-only
• adds PostgreSQL-backed integration testing to CI
• adds deployment, security, and contribution documentation
• improves desktop and mobile dashboard layouts

Why

The initial MVP covered tracking and authentication but left important pre-deployment gaps: fixed analytics windows, unpopulated location fields, on-demand metrics, incomplete security telemetry, missing logs, and insufficient deployment documentation. This PR closes those gaps while preserving the intentionally small, server-rendered admin surface.

Validation

• lint passed
• TypeScript typecheck passed
• 12 unit tests passed
• fresh Postgres 16 migration and analytics integration test passed
• production Next.js build passed
• npm audit reports zero vulnerabilities
• app, migration, and worker Docker targets built successfully
• full Docker Compose stack reached healthy state
• desktop and mobile browser flows passed with no console errors
• site creation, tracking ingestion, origin rejection, disabled ingestion behavior, security events, logs, ranged analytics, GeoIP headers, and runtime metrics were exercised end to end

Deployment notes

Review DEPLOYMENT.md and replace every production placeholder in .env before starting the stack. Runtime metrics represent what the container can observe and are not a substitute for authoritative host monitoring.