feat(admin): crawler observability dashboard + reliability hardening (0.55.0)

Admin-only crawler dashboard backed by an SSE live-status stream,
coordinated browser restart, runtime PHPSESSID refresh, dead-letter
requeue, and a batch of reliability fixes. Closes everything from
the two-pass audit (10 commits' worth) and bumps 0.52.0 -> 0.55.0.

Backend:

- New /admin/crawler/* surface (cookie-auth, RequireAdmin) split
  into status / control / dead_jobs / backlog modules. SSE stream
  composes in-memory status with DB-derived queue counts, memoizes
  the counts for 1s and debounces watch pokes for 250ms (~10x QPS
  reduction per subscriber). One-shot GET /admin/crawler shares the
  same compose path.
- POST /admin/crawler/run gated by manual_pass_lock try_lock_owned
  (409 Conflict on overlapping click); browser restart goes through
  the coordinated_restart gate (drain + relaunch + auto-clear of the
  sticky session_expired flag on Ok).
- Runtime PHPSESSID refresh via SessionController (allow-list
  validation, never logged, audit row carries SHA-256 fingerprint).
  Storage layer is repo::crawler::runtime_session_{load,persist}.
- Dead-letter requeue with four scopes (all/manga/chapter/job);
  scope=all requires confirm:true; DISTINCT ON dedup keeps the
  partial unique index from rejecting requeues for chapters with
  multiple dead rows. SQL is four &'static str constants per scope.
- StatusHandle + ChapterGuard / CoverGuard RAII model survives
  panics; last-writer-wins on cover so concurrent dispatches don't
  clobber each other's slot. Pure functions (should_stop /
  should_mark_clean_exit / should_abort_pass) with named regression
  tests.
- Reliability bundle: per-lease heartbeat, jitter on retries,
  per-job timeout, circuit breaker on consecutive failures, BrowserManager
  coordinated restart gate, request fingerprint changes.
- Streaming page download: Storage::put_stream trait method,
  LocalStorage impl atomic via temp + fsync + UUID-suffixed rename.
  Pages stream through with peak memory ~one HTTP chunk + 64-byte
  sniff prefix instead of one full image per dispatch.
- New partial indexes (migration 0022): mangas_missing_cover_idx
  and crawler_jobs_dead_idx, both ordered by updated_at DESC to
  match the dashboard's LIMIT/OFFSET reads.
- Security hardening: admin_csrf_guard (Origin/Referer allowlist
  on /admin/* mutations, opt-in via ADMIN_ALLOWED_ORIGINS),
  admin_no_store_guard (Cache-Control: no-store on admin
  responses), audit rows carry per-scope target_id.

Frontend:

- /admin/crawler page decomposed into lib/components/crawler/
  (11 components: ProgressBar, SearchBar, CrawlerHero,
  CrawlerControls, ActiveChaptersCard, ActiveJobsTable,
  MissingCoversTable, DeadJobsTable, RestartConfirmModal,
  RequeueAllConfirmModal, SessionModal). Page is 532 LOC of
  orchestration; each component 22-148 LOC.
- EventSource lifecycle wired to visibilitychange / pagehide /
  pageshow (BFCache); after 5 consecutive errors probes the status
  endpoint so a 401 routes through the global on401Hook instead of
  infinite silent reconnects.
- Backlog $effect refetches debounced 500ms with per-loader
  AbortControllers; refresh after a control action only runs when
  the SSE stream is dead.
- Inline requeue button on /admin/mangas patches the affected row's
  sync_state locally (no full chapter-list refetch); proper
  aria-label. Requeue-all gets its own confirm modal; both confirm
  modals autofocus Cancel.
- SvelteKit reverse proxy bypasses its 5-minute AbortController
  for Accept: text/event-stream; pure shouldBypassProxyTimeout
  helper covered by unit tests.

Config / docs:

- New env vars (.env.example): ADMIN_ALLOWED_ORIGINS,
  CRAWLER_JOB_TIMEOUT_SECS, CRAWLER_METADATA_MAX_CONSECUTIVE_FAILURES,
  CRAWLER_BROWSER_RESTART_THRESHOLD.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/tests/common/mod.rs

@@ -17,7 +17,7 @@ use tower::ServiceExt;
 use mangalord::app::{router, AppState};
 use mangalord::auth::rate_limit::AuthRateLimiter;
 use mangalord::config::{AuthConfig, UploadConfig};
-use mangalord::storage::{LocalStorage, Storage, StorageError, StreamingFile};
+use mangalord::storage::{LocalStorage, PutByteStream, Storage, StorageError, StreamingFile};
 
 use async_trait::async_trait;
 use std::sync::atomic::{AtomicUsize, Ordering};
@@ -78,6 +78,10 @@ fn harness_with_auth_config(
         // handlers return 503 in this config. Tests that need a stub
         // resync service swap it in via `harness_with_resync`.
         resync: None,
+        crawler: None,
+        // Empty allowlist = CSRF check skipped. The CSRF-specific test
+        // harness `harness_with_admin_origins` overrides this.
+        admin_allowed_origins: Arc::new(Vec::new()),
     };
     Harness { app: router(state), _storage_dir: storage_dir }
 }
@@ -152,6 +156,37 @@ pub fn harness_with_resync(
         },
         auth_limiter,
         resync: Some(resync),
+        crawler: None,
+        admin_allowed_origins: Arc::new(Vec::new()),
+    };
+    Harness {
+        app: router(state),
+        _storage_dir: storage_dir,
+    }
+}
+
+/// Like [`harness`] but configures an admin CSRF allowlist so the
+/// `/admin/*` mutating endpoints reject cross-origin browser POSTs.
+/// Used by the admin CSRF integration tests.
+pub fn harness_with_admin_origins(pool: PgPool, origins: Vec<String>) -> Harness {
+    let storage_dir = tempfile::tempdir().expect("tempdir");
+    let storage = Arc::new(LocalStorage::new(storage_dir.path()));
+    let auth_limiter = Arc::new(AuthRateLimiter::new(Default::default()));
+    let state = AppState {
+        db: pool,
+        storage,
+        auth: AuthConfig {
+            cookie_secure: false,
+            ..AuthConfig::default()
+        },
+        upload: UploadConfig {
+            max_request_bytes: 4 * 1024 * 1024,
+            max_file_bytes: 256 * 1024,
+        },
+        auth_limiter,
+        resync: None,
+        crawler: None,
+        admin_allowed_origins: Arc::new(origins),
     };
     Harness {
         app: router(state),
@@ -189,6 +224,22 @@ impl Storage for FailingStorage {
         }
         self.inner.put(key, bytes).await
     }
+    async fn put_stream(
+        &self,
+        key: &str,
+        stream: PutByteStream<'_>,
+    ) -> Result<u64, StorageError> {
+        // Count put_stream towards the same fail-index so tests that
+        // expect "the Nth put fails" don't care which entry point
+        // the caller took.
+        let n = self.counter.fetch_add(1, Ordering::SeqCst);
+        if n == self.fail_on_put_index {
+            return Err(StorageError::Io(std::io::Error::other(
+                "FailingStorage: injected put_stream failure",
+            )));
+        }
+        self.inner.put_stream(key, stream).await
+    }
     async fn get(&self, key: &str) -> Result<Vec<u8>, StorageError> {
         self.inner.get(key).await
     }
@@ -251,6 +302,44 @@ pub fn post_json_with_cookie(
         .unwrap()
 }
 
+/// Same as [`post_json_with_cookie`] but also attaches `Origin` (and
+/// optionally `Referer`) headers. Used by the admin CSRF tests to drive
+/// the cross-origin reject + allowed-origin accept paths.
+pub fn post_json_with_cookie_origin(
+    uri: &str,
+    body: serde_json::Value,
+    cookie: &str,
+    origin: Option<&str>,
+    referer: Option<&str>,
+) -> Request<Body> {
+    let mut b = Request::builder()
+        .method("POST")
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/json")
+        .header(header::COOKIE, cookie);
+    if let Some(o) = origin {
+        b = b.header(header::ORIGIN, o);
+    }
+    if let Some(r) = referer {
+        b = b.header(header::REFERER, r);
+    }
+    b.body(Body::from(body.to_string())).unwrap()
+}
+
+pub fn get_with_cookie_origin(
+    uri: &str,
+    cookie: &str,
+    origin: Option<&str>,
+) -> Request<Body> {
+    let mut b = Request::builder()
+        .uri(uri)
+        .header(header::COOKIE, cookie);
+    if let Some(o) = origin {
+        b = b.header(header::ORIGIN, o);
+    }
+    b.body(Body::empty()).unwrap()
+}
+
 pub fn post_json_with_bearer(
     uri: &str,
     body: serde_json::Value,