feat(admin): serve baked vue panel with usage charts

admin.go: GET /admin now serves the generated adminIndexHTML
(admin_assets_gen.go, webui/generate.mjs's output) instead of the old
adminPageHTML Go-string const (removed, ~340 lines, plus its now-dead
io import). New route GET /admin/assets/{hashedname}
(adminAssetsPathPrefix) serves the built app's content-hashed JS/CSS
from the generated adminAssets map - unauthenticated (same rationale as
GET /admin itself), Content-Type per asset, Cache-Control: public,
max-age=31536000, immutable, X-Content-Type-Options: nosniff; an
unknown name is a 404 in the standard OAI error envelope.

CSP tightens: script-src/style-src drop 'unsafe-inline' for 'self' (the
built app has no inline script or style of any kind - vite.config.ts's
build.modulePreload.polyfill:false sees to that), img-src gains 'self'
data:' for the shell's inlined-SVG favicon.

Makefile: new admin-ui target (npm ci && vite build, then
generate.mjs, then gofmt -w) - the only place Node is invoked; CI and
every other make target still need nothing beyond Go.

admin_test.go: TestAdminPage_CSPHeaderAndFetchURLs rewritten as a shell
test against the generated file (new CSP string, body references
/admin/assets/ and the <title>'s "LLM Gateway", no external
src=/href= reference - the favicon's xmlns attribute is excluded from
that check, it names an XML namespace URI, not a fetched resource);
TestAdmin_JSONSecurityHeaders' expected CSP updated; new
TestAdminAsset_Serving (Content-Type/nosniff/immutable-cache/byte-exact
body), TestAdminAsset_UnknownReturns404, and
TestAdminAssets_GeneratedFilePresent (non-empty index.html/assets, no
leftover {{/}}/generator-marker text leaked into the decoded HTML -
proves the base64 round-trip actually worked).

Makefile

@@ -3,7 +3,7 @@
 # two of them concurrently would corrupt each other's containers.
 .NOTPARALLEL:
 
-.PHONY: test lint yaegi-check integration integration-keep integration-up integration-wait integration-down
+.PHONY: test lint yaegi-check admin-ui integration integration-keep integration-up integration-wait integration-down
 
 test:
 	go test ./... -count=1
@@ -17,6 +17,18 @@ lint:
 	fi
 	go vet ./...
 
+# admin-ui rebuilds the Vue admin panel (webui/) and regenerates
+# admin_assets_gen.go — the repo-root Go file admin.go's serveAdminPage/
+# serveAdminAsset actually serve. Only ever needed after a webui/ source
+# change; CI never runs this (admin_assets_gen.go is committed, and
+# .gitattributes export-ignores webui/ from release source tarballs — see
+# its own comment), so CI never needs node. `npm ci` requires
+# webui/package-lock.json, which is committed for exactly this.
+admin-ui:
+	cd webui && npm ci && npm run build
+	node webui/generate.mjs
+	gofmt -w admin_assets_gen.go
+
 yaegi-check:
 	cd tools/yaegi-check && GOWORK=off go run . $(CURDIR)