feat: add native OpenAnalytics admin overview

[christopherjnelson]

OpenAnalytics now has a native EmDash admin page showing connection and tracking status, validation controls, visitors/pageviews/events, server-provided previous-period totals, and a visitors/pageviews chart. Administrators can choose 24h, 7d, 30d (default), or 90d, with freshness and actionable error notices.

The page uses Block Kit without a browser plugin bundle, application framework, chart dependency, polling, or production dependency additions. Analytics reads occur only on page interactions through a protected plugins:manage POST route. Private keys remain server-side; public tracking remains bound to the validated API URL/key fingerprint.

Changes

• Add typed, validated /v1/read/analytics/overview and /v1/read/analytics/timeseries reads with explicit UTC bounds, IANA timezone, and resolution. Overview requests comparisons in the same HTTP read; visitor buckets are never reaggregated.
• Retain matching known-good public tracker snapshots when revalidation encounters network failures, timeouts, rate limits, or server errors. Credential rejection and malformed installation responses invalidate the snapshot; mismatched configurations cannot use it.
• Add a native timezone setting because EmDash's plugin context does not expose the site's timezone. Native chart labels use browser timezone; the page discloses this and shows effective queried ranges.
• Correct README fingerprint-binding wording, update verified upstream contracts and implementation-footprint comparison, and upgrade CI actions to current Node 24 majors.

Contract details

Current OpenAnalytics rejects forced daily overview resolution for non-UTC offsets, so overview always requests hour; the chart requests hour for 24h and day for longer presets. Effective bounds can differ after rollup snapping. Freshness watermark is the latest rolled-up bucket, not a complete-through guarantee. Suspended analytics returns 403 SITE_SUSPENDED; 402 remains a legacy billing mapping.

Validation

• All 96 tests pass on Node 22.23.2 and Node 24.18.0, including the original 37 scaffold tests.
• Full pnpm run check passes on both: typecheck, lint, formatting, tests, build, package verification, and npm package dry-run.
• Artifact scan finds only private-key prefix validation expressions, no concrete credential. Native BlockRenderer server rendering smoke check confirms safe HTML.
• Luna Medium agents handled research, implementation, testing, and independent review; findings were resolved and the final code personally inspected.
• Production: 1,458 LOC (+963); tests: 1,923 LOC (+1,202). No npm publication.

PR #3 recommendation: add Top Pages and Sources using native tables, retaining the same range, timezone, and server-side read boundaries.