feat(admin): add visitor analytics dashboard UI #622

Context

Issue #621 adds the visitor analytics API. This issue adds the admin UI so operators can see human visitor statistics, current online users, admin/public activity, device/browser distribution, and online geolocation when enabled.

The UI must follow existing AWCMS-Mini admin patterns: server-side permission checks, clear access-denied state, error state, empty state, responsive layout, and i18n.

Objective

Add /admin/analytics dashboard UI for visitor analytics.

Scope

Add page:

src/pages/admin/analytics.astro

Optional components:

src/components/admin/analytics/*

Dashboard sections/cards:

1. Total human visitors currently online.
2. Users currently accessing admin pages.
3. Visitors currently accessing public pages.
4. Human visitors in the last 24 hours.
5. Human visitors in the last 7 days.
6. Human visitors in the last 30 days.
7. Public top pages.
8. Admin top pages.
9. Device/browser distribution.
10. Country/location summary when geo is enabled.
11. Bot/suspicious traffic summary.
12. Active sessions table.

Filters:

• Area: all, admin, public, api.
• Visitor type: human, bot, all.
• Range: 24h, 7d, 30d, 12m where supported.

Data loading:

• Use the analytics application/API layer added in feat(visitor-analytics): add analytics API and OpenAPI contract #621.
• Do not query unrestricted raw detail from the UI.
• Do not perform client-side direct DB access.

Out of scope

• API implementation.
• Middleware collector.
• Rollup/purge jobs.
• External analytics integration.
• Heatmaps, session recording, or behavioral replay.
• CSV/export unless implemented as a separate follow-up.

Acceptance criteria

• /admin/analytics is registered in module navigation from feat(visitor-analytics): add module descriptor, permissions, and configuration gate #617.
• User without visitor_analytics.dashboard.read sees an access-denied state.
• User without visitor_analytics.raw_detail.read does not see raw IP, raw user-agent, detailed path history, or login identifier detail.
• Dashboard shows realtime counts: online human, admin online, public online.
• Dashboard shows 24h, 7d, and 30d human visitor summaries.
• Dashboard shows top pages, device/browser, and bot summary.
• Location section is hidden or shows a safe disabled state when geolocation is disabled.
• Empty state is clear when no analytics data exists.
• Error state is clear and does not leak stack traces.
• UI is responsive and follows existing admin design tokens/components.
• i18n strings are added for Indonesian and English where the repo currently expects both.
• Tests cover access denied, aggregate view, raw-detail gating, and empty/error states.
• bun run test:e2e is added/run if the UI is non-trivial and test environment supports it.
• bun run check passes.

Security and privacy notes

• Raw detail must never appear by accident in aggregate cards.
• Do not display full query strings.
• Do not display cookie, token, authorization, password, reset, or MFA challenge values.
• Treat current admin page visibility as sensitive operational data and gate it appropriately.
• The UI must not be the only enforcement point; server-side APIs remain mandatory guards.

Dependencies

Depends on #617 and #621. It becomes fully useful after #620 is collecting data.