refactor(web): remove deprecated dashboard components and enhance KPI grid

- Deleted unused components: `DashboardActivityTimeline`, `DashboardFramePanel`, `DashboardModulesGrid`, `DashboardRecentJobsGrid`, and `DashboardRecentRevisionsGrid` to streamline the dashboard.
- Updated `DashboardKpiGrid` to improve KPI display logic, including progress indicators and enhanced badge functionality.
- Refactored `DashboardNetworkHealth` to provide better status representation based on loading states and network conditions.
- Introduced new properties for KPI cards to support progress tracking and improved visual feedback.

This cleanup aims to enhance performance and maintainability of the dashboard while providing a better user experience.

internal/pipeline/cdn_url.go

@@ -7,7 +7,9 @@ import (
 	"net/netip"
 	"net/url"
 	"os"
+	"strconv"
 	"strings"
+	"sync"
 	"time"
 )
 
@@ -91,6 +93,9 @@ func ResolveCDNURLHost(ctx context.Context, raw string) error {
 	if isBlockedCDNHostname(host) {
 		return fmt.Errorf("pipeline: cdn url blocked host")
 	}
+	if ok := cdnDNSVerifyCache.hit(host); ok {
+		return nil
+	}
 	if ctx == nil {
 		ctx = context.Background()
 	}
@@ -112,5 +117,64 @@ func ResolveCDNURLHost(ctx context.Context, raw string) error {
 			return fmt.Errorf("pipeline: cdn url resolves to blocked address")
 		}
 	}
+	cdnDNSVerifyCache.store(host)
 	return nil
 }
+
+// cdnDNSVerifyTTL bounds how long a successful SSRF check is trusted for one hostname.
+// Failures are never cached: a transient DNS outage must not open an unsafe window,
+// and a blocked host is rejected before this cache anyway.
+func cdnDNSVerifyTTL() time.Duration {
+	sec := 300
+	if s := strings.TrimSpace(os.Getenv("EVOBGP_CDN_DNS_CACHE_TTL_SEC")); s != "" {
+		if v, err := strconv.Atoi(s); err == nil && v > 0 {
+			sec = v
+		}
+	}
+	return time.Duration(sec) * time.Second
+}
+
+type dnsVerifyCache struct {
+	mu   sync.Mutex
+	seen map[string]time.Time
+}
+
+var cdnDNSVerifyCache = &dnsVerifyCache{seen: make(map[string]time.Time)}
+
+func (c *dnsVerifyCache) hit(host string) bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	at, ok := c.seen[host]
+	return ok && time.Since(at) < cdnDNSVerifyTTL()
+}
+
+func (c *dnsVerifyCache) store(host string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.seen == nil {
+		c.seen = make(map[string]time.Time)
+	}
+	c.seen[host] = time.Now()
+	if len(c.seen) > 4096 {
+		// Size cap for long-running workers: drop expired entries, then the oldest if needed.
+		now := time.Now()
+		for h, at := range c.seen {
+			if now.Sub(at) >= cdnDNSVerifyTTL() {
+				delete(c.seen, h)
+			}
+		}
+		if len(c.seen) > 4096 {
+			var oldestK string
+			var oldestT time.Time
+			first := true
+			for h, at := range c.seen {
+				if first || at.Before(oldestT) {
+					oldestK, oldestT, first = h, at, false
+				}
+			}
+			if oldestK != "" {
+				delete(c.seen, oldestK)
+			}
+		}
+	}
+}