Blocking: count Advanced Blocking, Dashboard layout and KPI cards

- Status, sidebar mark and header treat a server that blocks with the
  Advanced Blocking app as blocking, per server behind the hub.
- Overview panel summarising the app's groups; Lists and Rules show and
  edit the app's list URLs and rules (read, change one field, write back).
- Block List Domains adds the app's list domains, counted by the hub
  (hub/blocking/app-lists/count, public hosts only unless
  HUB_LISTS_ALLOW_PRIVATE=1) or by the browser where CORS allows.
- Header and KPI cards follow the Dashboard: selector in the chrome slot,
  Compare servers in the header actions, period under the title, StatCard
  tiles without sparklines.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

hub/config.ts

@@ -36,6 +36,8 @@ export interface HubConfig {
   webhookUrl: string | null
   /** Signs the notices with HMAC-SHA256 (HUB_WEBHOOK_SECRET); null when not set. Never logged. */
   webhookSecret: string | null
+  /** Lets the block list counter fetch from private addresses (HUB_LISTS_ALLOW_PRIVATE=1), for lists kept on the LAN. */
+  listsAllowPrivate: boolean
   /** Shown as `dnsServerDomain` (and `clusterDomain`) in the session. */
   domain: string
   /** The console's static build. */
@@ -111,6 +113,7 @@ export function parseConfig(env: Env): HubConfig {
     timeoutMs: number(env, 'HUB_TIMEOUT_MS', 8000, 1),
     webhookUrl: webhookUrl === '' ? null : webhookUrl,
     webhookSecret: (env.HUB_WEBHOOK_SECRET ?? '') === '' ? null : (env.HUB_WEBHOOK_SECRET as string),
+    listsAllowPrivate: ['1', 'true'].includes((env.HUB_LISTS_ALLOW_PRIVATE ?? '').trim().toLowerCase()),
     domain: env.HUB_DOMAIN?.trim() || 'hub',
     staticDir: env.HUB_STATIC?.trim() || './dist',
   }