feat: M14 — Observability (dashboard charts, agent fleet, stats API, metrics, structured logging, rollback)

Backend: StatsService with 5 aggregation methods, JSON metrics endpoint, slog-based
structured logging middleware. Stats API: dashboard summary, certificates-by-status,
expiration timeline, job trends, issuance rate. 23 new backend tests.

Frontend: Recharts-powered dashboard with 4 charts (status pie, expiration heatmap,
job trends line, issuance bar), agent fleet overview page with OS/arch grouping and
version breakdown, deployment rollback buttons on version history. 7 new frontend tests.

78 API endpoints, 744+ total tests (658 Go + 86 Vitest).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/integration/lifecycle_test.go

@@ -75,6 +75,8 @@ func TestCertificateLifecycle(t *testing.T) {
 	agentGroupHandler := handler.NewAgentGroupHandler(&mockAgentGroupService{})
 	auditHandler := handler.NewAuditHandler(auditService)
 	notificationHandler := handler.NewNotificationHandler(notificationService)
+	statsHandler := handler.NewStatsHandler(&mockStatsService{})
+	metricsHandler := handler.NewMetricsHandler(&mockStatsService{}, time.Now())
 	healthHandler := handler.NewHealthHandler("none")
 
 	// Create router and register handlers
@@ -92,6 +94,8 @@ func TestCertificateLifecycle(t *testing.T) {
 		agentGroupHandler,
 		auditHandler,
 		notificationHandler,
+		statsHandler,
+		metricsHandler,
 		healthHandler,
 	)
 
@@ -1109,3 +1113,26 @@ func (m *mockRevocationRepository) MarkIssuerNotified(ctx context.Context, id st
 	}
 	return fmt.Errorf("revocation not found")
 }
+
+// mockStatsService implements both handler.StatsService and handler.MetricsService for integration tests.
+type mockStatsService struct{}
+
+func (m *mockStatsService) GetDashboardSummary(ctx context.Context) (interface{}, error) {
+	return &handler.DashboardSummary{}, nil
+}
+
+func (m *mockStatsService) GetCertificatesByStatus(ctx context.Context) (interface{}, error) {
+	return map[string]int64{}, nil
+}
+
+func (m *mockStatsService) GetExpirationTimeline(ctx context.Context, days int) (interface{}, error) {
+	return []interface{}{}, nil
+}
+
+func (m *mockStatsService) GetJobStats(ctx context.Context, days int) (interface{}, error) {
+	return []interface{}{}, nil
+}
+
+func (m *mockStatsService) GetIssuanceRate(ctx context.Context, days int) (interface{}, error) {
+	return []interface{}{}, nil
+}

internal/integration/negative_test.go

@@ -69,6 +69,8 @@ func setupTestServer(t *testing.T) (*httptest.Server, *mockCertificateRepository
 	agentGroupHandler := handler.NewAgentGroupHandler(&mockAgentGroupService{})
 	auditHandler := handler.NewAuditHandler(auditService)
 	notificationHandler := handler.NewNotificationHandler(notificationService)
+	statsHandler := handler.NewStatsHandler(&mockStatsService{})
+	metricsHandler := handler.NewMetricsHandler(&mockStatsService{}, time.Now())
 	healthHandler := handler.NewHealthHandler("none")
 
 	r := router.New()
@@ -85,6 +87,8 @@ func setupTestServer(t *testing.T) (*httptest.Server, *mockCertificateRepository
 		agentGroupHandler,
 		auditHandler,
 		notificationHandler,
+		statsHandler,
+		metricsHandler,
 		healthHandler,
 	)