feat(observability): phase 1 - schema, models & event log backend

Add database foundation for observability features:
- event_log table with severity/source filtering and pagination
- standalone_proxies table for user-created reverse proxies
- stale_threshold_days setting (default 7 days)
- Auto-persist warn/error events from event bus to database
- SSE broadcast of persistent events for real-time UI updates
- Frontend types and API functions for downstream UI phases

internal/api/settings.go

@@ -24,7 +24,8 @@ type settingsRequest struct {
 	NpmEmail         string `json:"npm_email"`
 	NpmPassword      string `json:"npm_password"`
 	PollingInterval  string `json:"polling_interval"`
-	SSLCertificateID *int   `json:"ssl_certificate_id,omitempty"`
+	SSLCertificateID   *int `json:"ssl_certificate_id,omitempty"`
+	StaleThresholdDays *int `json:"stale_threshold_days,omitempty"`
 }
 
 // getSettings handles GET /api/settings.
@@ -37,17 +38,18 @@ func (s *Server) getSettings(w http.ResponseWriter, r *http.Request) {
 
 	// Return settings without sensitive fields.
 	respondJSON(w, http.StatusOK, map[string]any{
-		"domain":              settings.Domain,
-		"server_ip":           settings.ServerIP,
-		"network":             settings.Network,
-		"subdomain_pattern":   settings.SubdomainPattern,
-		"notification_url":    settings.NotificationURL,
-		"npm_url":             settings.NpmURL,
-		"npm_email":           settings.NpmEmail,
-		"has_npm_password":    settings.NpmPassword != "",
-		"polling_interval":    settings.PollingInterval,
-		"ssl_certificate_id":  settings.SSLCertificateID,
-		"updated_at":          settings.UpdatedAt,
+		"domain":               settings.Domain,
+		"server_ip":            settings.ServerIP,
+		"network":              settings.Network,
+		"subdomain_pattern":    settings.SubdomainPattern,
+		"notification_url":     settings.NotificationURL,
+		"npm_url":              settings.NpmURL,
+		"npm_email":            settings.NpmEmail,
+		"has_npm_password":     settings.NpmPassword != "",
+		"polling_interval":     settings.PollingInterval,
+		"ssl_certificate_id":   settings.SSLCertificateID,
+		"stale_threshold_days": settings.StaleThresholdDays,
+		"updated_at":           settings.UpdatedAt,
 	})
 }
 
@@ -101,6 +103,13 @@ func (s *Server) updateSettings(w http.ResponseWriter, r *http.Request) {
 		updated.SSLCertificateID = *req.SSLCertificateID
 		sslChanged = true
 	}
+	if req.StaleThresholdDays != nil {
+		if *req.StaleThresholdDays < 1 {
+			respondError(w, http.StatusBadRequest, "stale_threshold_days must be at least 1")
+			return
+		}
+		updated.StaleThresholdDays = *req.StaleThresholdDays
+	}
 
 	if err := s.store.UpdateSettings(updated); err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to update settings: "+err.Error())