Add admin UI: per-host visibility overrides and manual targets

NPM stays the source of truth for which domains exist; this adds an
optional enrichment layer on top of the existing NPM_INCLUDE_PATTERNS
filtering, gated behind ADMIN_PASSWORD (disabled entirely if unset).

- Force-show/force-hide any NPM-discovered host regardless of what
  the include pattern would otherwise decide
- Per-host display name and check path overrides
- Manually add targets that aren't proxied through NPM at all
- Every override falls back to the NPM-derived default when unset —
  a host with no override behaves exactly as before this existed

Host overrides and manual targets live in SQLite (better-sqlite3,
WAL mode) and are re-read on every 60s check tick, so admin changes
take effect within one cycle with no restart. NPM host discovery
keeps its original 10-minute cadence — only the local override reads
happen every tick.

The core merge (NPM hosts + overrides + manual targets -> final
check list) is a pure function in targets.ts, kept separate from the
checker's I/O for testability. Verified end-to-end against a local
mock NPM server (auth, force-show/hide, rename, custom check path,
manual targets, reset-to-default all propagate correctly) and against
the actual Docker build/runtime (better-sqlite3's native addon builds
and loads correctly in the Alpine image).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -1,5 +1,8 @@
 FROM node:22-alpine AS build
 WORKDIR /app
+# better-sqlite3 has a native addon with no prebuilt binary for this
+# platform/Node combo yet — build it from source.
+RUN apk add --no-cache python3 make g++
 COPY package*.json ./
 RUN npm install
 COPY . .
@@ -7,8 +10,16 @@ RUN npm run build
 
 FROM node:22-alpine
 WORKDIR /app
+# Same native-addon rebuild needed for the production-only install below;
+# the toolchain is purged again afterward to keep the runtime image lean.
+RUN apk add --no-cache python3 make g++
 COPY package*.json ./
-RUN npm install --omit=dev
+RUN npm install --omit=dev && apk del python3 make g++
 COPY --from=build /app/dist ./dist
+
+# DATA_DIR (SQLite DB) is a mutable runtime volume — not baked into the
+# image, so redeploys don't clobber host overrides / manual targets.
+ENV DATA_DIR=/app/data
+
 EXPOSE 3035
 CMD ["node", "dist/index.js"]