feat(webui): vue admin panel source

Vue 3 + TypeScript + Pinia + Tailwind v4 + shadcn-vue + Chart.js admin
panel source under webui/, built with Vite. Views: Overview (providers,
redis/cache/retry status, model aliases), Usage (per-user/per-group/total
tables with tokensIn/tokensOut/cost + limits), Charts (scope selector,
req/tokens(stacked in-out)/cost metric tabs, 24h/30d/12mo window
switcher, fed by GET /admin/api/usage/history). Pinia stores: auth
(sessionStorage key gate, x-api-key header, 401/403 re-prompt),
dashboard (5s poll), history (fetch-on-selection + 30s refresh).

Design: deliberate neutral warm-neutral palette with a signature teal
accent (no default Inter/purple-gradient/glassmorphism), real
typographic hierarchy via the platform UI/mono font stacks (zero
external assets - no Google Fonts), dark+light via prefers-color-scheme
(no class toggle, no theme switcher). Charts: zero-based bars, honest
axes, Okabe-Ito colorblind-safe series, tokens-in/out as a
distinguishable stacked pair.

vite.config.ts: base '/admin/' (matches admin.go's route layout) and
build.modulePreload.polyfill:false (no inline bootstrap script, so the
tightened admin CSP needs no 'unsafe-inline'). Code-split: Chart.js
(ChartsView) loads lazily, not in the initial bundle.

generate.mjs reads dist/ after `vite build` and writes
../admin_assets_gen.go (not committed by this change) - base64-encodes
every asset, decoded once at package-var init; documented rationale in
the script's own header comment.

Hygiene: webui/go.mod walls webui/ off from the repo root's `go build`/
`vet`/`test ./...` (npm's node_modules bundles a stray .go file that
would otherwise be swept in); tools/yaegi-check/main.go excludes webui/
from its GOPATH copy for the same reason. webui/ export-ignored
(.gitattributes) from release source tarballs; webui/node_modules/
gitignored. tsconfig.app.json/tsconfig.node.json's JSONC comments
dropped (TS itself is fine with either; the global pre-commit JSON
validator is not) - no config values changed.

webui/src/components/AuthGate.vue

@@ -0,0 +1,52 @@
+<script setup lang="ts">
+import { faKey } from '@fortawesome/free-solid-svg-icons'
+import { ref } from 'vue'
+
+import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert'
+import { Button } from '@/components/ui/button'
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
+import { Input } from '@/components/ui/input'
+import { useAuthStore } from '@/stores/auth'
+
+const auth = useAuthStore()
+const keyInput = ref('')
+
+function submit(): void {
+  const value = keyInput.value
+  keyInput.value = ''
+  auth.submit(value)
+}
+</script>
+
+<template>
+  <div class="mx-auto flex min-h-[70vh] max-w-md flex-col justify-center px-4">
+    <Card>
+      <CardHeader>
+        <CardTitle class="flex items-center gap-2">
+          <FontAwesomeIcon :icon="faKey" class="size-4 text-primary" />
+          Admin key required
+        </CardTitle>
+        <CardDescription>
+          Enter an admin API key. The browser keeps it only in this tab's session storage: it is
+          never written to disk and is sent only to this page's own /admin/api/* requests.
+        </CardDescription>
+      </CardHeader>
+      <CardContent class="flex flex-col gap-4">
+        <form class="flex flex-col gap-3" @submit.prevent="submit">
+          <Input
+            v-model="keyInput"
+            type="password"
+            autocomplete="off"
+            placeholder="API key"
+            aria-label="Admin API key"
+          />
+          <Button type="submit" class="w-full">Continue</Button>
+        </form>
+        <Alert v-if="auth.error" variant="destructive">
+          <AlertTitle>Authentication failed</AlertTitle>
+          <AlertDescription>{{ auth.error }}</AlertDescription>
+        </Alert>
+      </CardContent>
+    </Card>
+  </div>
+</template>