Add admin dashboard at / with bearer-token overview API

README.md

@@ -50,6 +50,17 @@ Every flag also reads an environment variable (`tunneld -h`):
 | `-http-mode` | `HTTP_MODE` | `serve` | `serve` = plain-HTTP app (dev); `redirect` = 301 to the domain |
 | `-data` | `TUNNELD_DATA` | `$XDG_DATA_HOME/tunneld/data.json` | tunnel store (0600) |
 | `-ca-file` | `LOCAL_CA_FILE` | `<data dir>/ca.pem` | where the local CA cert is written |
+| `-admin-token` | `ADMIN_TOKEN` | *(empty)* | bearer token for the admin dashboard; empty disables the admin API |
+
+## Admin dashboard
+
+With `ADMIN_TOKEN` set, `https://<domain>/` (and `/admin`) serves a small
+self-contained dashboard: server uptime and version, CA expiry, tunnels with
+state/routes/cert expiry, and attached bridges with client version and live
+connection counts. The page stores the token in `localStorage` and polls
+`GET /api/admin/overview` (`Authorization: Bearer <ADMIN_TOKEN>`) every 5
+seconds. Without `ADMIN_TOKEN` the endpoint answers 503 and the page is
+inert; with a wrong token, 401.
 
 ## Deploy on Coolify (or any Docker host)
 
@@ -93,6 +104,7 @@ publicly trusted.
   heartbeats, idle retirement, `open`/`end`/`reset`, 32 KiB data frames
 - SNI routing on the TLS listener: the domain is terminated (API), tunnel
   hostnames are passed through still encrypted
+- Admin dashboard at `/` (bearer `ADMIN_TOKEN`): tunnels, bridges, CA expiry
 - Persistence: JSON store with the CA, server certificate, and tunnels
 - Graceful shutdown: `drain` + close to every bridge