feat(dashboard): windowed metric cards — backend + frontend

[surpradhan]

What does this PR do?

Adds optional time-window filtering to the metric cards at the top of the dashboard. A pill-row picker (All time / 1h / 24h / 7d) lets operators quickly scope the key counters to a recent window without leaving the page.

Changes

Backend (GET /metrics)

• Accepts optional ?since and ?until (ISO-8601) query params
• Both SQLite and Postgres backends: windowed path uses dynamic WHERE clauses on events.time / sessions.started_at; the existing fast-path (pre-compiled prepared statements) is unchanged when no window is set
• Server-wide process counters (received, rejected, duplicates) have no timestamps and remain lifetime totals regardless of window
• Returns windowed: { since, until } in the response when a window is active
• 400 on malformed date strings

Frontend

• Window-picker pill row above the metric grid (All time / 1h / 24h / 7d)
• DB-backed cards (Sessions, Accepted, Workflows) gain a duration suffix when a window is active (e.g. "Sessions (24h)")
• Received / Rejected cards show `(all time)` to be transparent that they can't be filtered
• `setMetricWindow()` + standalone `loadMetrics()` so the window refreshes independently of the full `loadAll()` session/timeline fetch

How to test

```bash
npm run ingest

open dashboard, click 1h / 24h / 7d pills — metric cards update instantly

curl -H "Authorization: Bearer " \
"http://localhost:8787/metrics?since=$(date -u -v-1H +%Y-%m-%dT%H:%M:%SZ)"

→ { accepted: N, session_count: N, ..., windowed: { since: "...", until: null } }

curl -H "Authorization: Bearer " "http://localhost:8787/metrics?since=not-a-date"

→ 400 { error: "invalid since/until..." }

```

Checklist

• Tests pass (243/243, +4 new integration tests)
• Lint clean
• No new CI jobs
• No schema migrations

Closes: part of UX polish sprint (PR-C of 4)

[surpradhan]

Round 1 findings (all fixed in 757f006): (1) Date.parse accepted non-ISO strings → normalized via new Date().toISOString(); (2) vacuous 4th test → replaced with positive-side assertion (accepted >= 1 in past window, = 0 in future window); (3) windowed boolean missing parens → added in both backends; (4) SSE nudge() not gated → wrapped in if (!metricWindow); (5) OpenAPI not updated → since/until params + windowed field + 400 response added.

Round 2 finding (fixed in ca0b16d): refreshSessions()/buildWorkflowList() were overwriting windowed metric cards with lifetime totals on every SSE tick → both writes gated on !metricWindow.

Round 3: both reviewers approve, zero actionable items. 243/243 tests, lint clean. Approve.