[3/6] Add the /ui/analytics page

[wickedOne]

/ui/analytics: download volume, per-ecosystem breakdown and a runtime card

Part 3 of six splitting #381 ("analytics dashboard") into reviewable pieces, as the review there asked for. #381 stays open as the umbrella and reference thread until the last of these lands; it is not meant to be merged.

Series: #388 route coverage · #389 ecosystem stats · #390 analytics page · #391 /stats breakdown · #392 Grafana dashboard · #393 source attribution

Needs #389, and branches off it, so until #389 merges the Files changed tab here shows both. The last commit is this part.

/ui/ reported what the cache holds but nothing about what it has served, and most of what /metrics exposes had no home in the UI at all. This adds a second page.

The page carries a ring of download size by ecosystem with the total in the middle (six slices maximum, the tail folded into "Other" and named in the legend), the cache figures from /ui/, a per-ecosystem table, the vulnerability overview, and a Runtime card covering every remaining metric.

No history is stored

The proxy keeps no time series. The page reads the database and the in-process registry at request time and reports current state; history, trends and alerting are Prometheus and Grafana's job. That splits the figures in two and the page says which is which: database-derived figures survive a restart, while everything in the Runtime card lives only in this process's registry and restarts from zero.

When the aggregation fails but a previous snapshot was retained, the page serves the stale figures behind an amber banner saying when they were read. Without that distinction a database down for an hour renders hour-old numbers as current, with the failure visible only in the logs.

Also in here

metrics.Gather() and a small Snapshot type, so the UI can render counters that were never in the database. The Runtime card is its only caller, which is why this is not in part 2.

proxy_response_bytes_total{ecosystem} and byte counting on the response writer -- the Runtime card's "Served" tile is its first consumer. The ecosystem label here comes from the request path, not the package record; the README now sets out all three label sets side by side, since that is the thing most likely to produce a wrong query.

The Security Overview block moves out of dashboard.html into a shared component so the two pages cannot drift.

TestEveryMetricIsSurfaced makes the page a required consumer of every future metric: adding one fails the build until a tile exists. That is deliberate, and per the review it is now written down rather than discovered -- a comment on metricSurface and a line under Code Style in CONTRIBUTING.md.

avgArtifactSize returned an em dash for the empty case, flagged in the review; it returns 0 B. joinLabels and formatDuration return -, where 0 B would be meaningless.