Admin panel (:8767): config, profiles, service control, paper/live switch

New admin service — LAN-only, token-authed (ADMIN_TOKEN), card-based UI
matching the owner's preferred dashboard style. Capabilities:
- health: docker containers via /var/run/docker.sock (stdlib unix-socket
  HTTP client), DB heartbeat, Alpaca account/clock, Ollama, feed
- config: whitelisted strategy knobs (TRADING_/TRIGGER_/WATCHER_/...)
  edited via data/overrides.env, which every entrypoint now loads with
  override=True at boot (runtime/env_overrides.py) — so changes apply on
  container restart without touching the deployment YAML; secrets are
  presence-only and rejected server-side if edited
- profiles: named knob presets (seeded: validated-core, conservative,
  squeeze-hunter) applied in one click
- restart buttons per container; paper/live switch guarded behind
  ALPACA_LIVE_* keys existing
Verified live in docker: auth 401s, status/config/profiles/write paths,
secret-edit rejection, page serves. Added to both compose files.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

dashboard_api.py

@@ -19,6 +19,8 @@ from dotenv import load_dotenv
 # 192.168.1.5:5432) — the event store reads it. Without this the standalone
 # dashboard fell back to the legacy local DuckDB path and showed nothing.
 load_dotenv()
+from runtime.env_overrides import load as _load_overrides
+_load_overrides()  # admin-panel overrides beat compose env
 
 from api.main import DashboardState, create_server  # noqa: E402