Show CrowdSec security status for proxy servers

[arjunkomath]

Summary

• collect bounded CrowdSec LAPI, Traefik acquisition, bouncer, active-decision, and recent-alert status from proxy agents
• collect CrowdSec asynchronously and atomically publish the last completed snapshot so heartbeat and work-queue reporting never wait on cscli
• persist the latest normalized snapshot on each server through the existing signed status report
• add a proxy-only Security tab with component health, active blocks, and recent threats
• poll CrowdSec data through an authenticated server-scoped endpoint; cluster-health responses do not include security snapshots
• trim cluster-health to critical summary counts and per-server network/container/agent health, removing its VictoriaMetrics request and upgrade/resource payloads

Verification

• go test ./... from agent/
• web TypeScript typecheck
• Biome checks for all touched web files
• pnpm test from web/ (427 tests)
• final focused Oracle review completed; nullable API fallback finding fixed

Deployment note

The existing Drizzle schema-push step must apply the new nullable servers.crowdsec_health JSONB column before the updated web service starts.

Basecamp: https://app.basecamp.com/5890597/buckets/47439993/todos/10157951692

[github-actions]

React Doctor found no issues. 🎉

⚠️ Warning: .github/workflows/react-doctor.yml is configured incorrectly. See below to fix.

React Doctor compares against main to report only the issues this pull request introduces. This run couldn't complete that comparison (usually a shallow CI checkout with no merge base), so it listed every issue in the changed files, including ones that already existed on main.

Add fetch-depth: 0 to the actions/checkout step in .github/workflows/react-doctor.yml so the checkout includes the history React Doctor needs:

 jobs:
   react-doctor:
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

       - uses: millionco/react-doctor@v2

To silence this warning, set silence-missing-baseline-warning: true on the React Doctor action.

_{Reviewed by React Doctor for commit cccaf86.}