feat: daemon health panel, brand-rail status chips, user timezone selector

- Health API now surfaces Docker /info + /version (version, platform,
  kernel, container/image counts, storage driver, memory, latency) and
  NPM aggregates (proxy host total, managed-by-Tinyforge count, access
  lists, certificates, endpoint URL).
- Docker/NPM indicators moved out of the sidebar footer and into a
  compact mono-styled rail directly under the Tinyforge brand title,
  with pulse/fault animations and click-to-expand error hints.
- New SystemDaemonsCard on the dashboard: two terminal-styled panels
  (Docker Engine + Proxy) with a running/paused/stopped stacked bar,
  key-value diagnostics, and a total-vs-managed proportion meter on
  the proxy-hosts tile.
- Shared health store so the sidebar and dashboard share a single
  30 s poll instead of duplicating traffic.
- User-facing timezone preference with auto-detect fallback; all
  dates across projects, sites, stacks, settings, backup, event log
  and stale containers now render through \$fmt.date / \$fmt.datetime.
- en/ru translations for both features.

internal/proxy/npm_provider.go

@@ -121,6 +121,14 @@ func (p *NpmProvider) Ping(ctx context.Context) error {
 	return p.client.Ping(ctx)
 }
 
+// Authenticate is a public wrapper over the internal auth step. It is used by
+// health checks that want to make authenticated list calls without going
+// through the full ConfigureRoute path. Returns an error if credentials are
+// not configured or the NPM API rejects them.
+func (p *NpmProvider) Authenticate(ctx context.Context) error {
+	return p.auth(ctx)
+}
+
 // auth authenticates to NPM if credentials are available.
 func (p *NpmProvider) auth(ctx context.Context) error {
 	if p.email == "" {