Add React UI with Execution Explorer, auth, and standalone deployment

- Scaffold Vite + React + TypeScript frontend in ui/ with full design
  system (dark/light themes) matching the HTML mockups
- Implement Execution Explorer page: search filters, results table with
  expandable processor tree and exchange detail sidebar, pagination
- Add UI authentication: UiAuthController (login/refresh endpoints),
  JWT filter handles ui: subject prefix, CORS configuration
- Shared components: StatusPill, DurationBar, StatCard, AppBadge,
  FilterChip, Pagination — all using CSS Modules with design tokens
- API client layer: openapi-fetch with auth middleware, TanStack Query
  hooks for search/detail/snapshot queries, Zustand for state
- Standalone deployment: Nginx Dockerfile, K8s Deployment + ConfigMap +
  NodePort (30080), runtime config.js for API base URL
- Embedded mode: maven-resources-plugin copies ui/dist into JAR static
  resources, SPA forward controller for client-side routing
- CI/CD: UI build step, Docker build/push for server-ui image, K8s
  deploy step for UI, UI credential secrets

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Install Node.js
         run: |
-          apt-get update && apt-get install -y nodejs
+          apt-get update && apt-get install -y nodejs npm
 
       - uses: actions/checkout@v4
 
@@ -44,6 +44,12 @@ jobs:
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: ${{ runner.os }}-maven-
 
+      - name: Build UI
+        working-directory: ui
+        run: |
+          npm ci
+          npm run build
+
       - name: Build and Test
         run: mvn clean verify -DskipITs --batch-mode
 
@@ -66,7 +72,7 @@ jobs:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
       - name: Set up QEMU for cross-platform builds
         run: docker run --rm --privileged tonistiigi/binfmt --install all
-      - name: Build and push
+      - name: Build and push server
         run: |
           docker buildx create --use --name cibuilder
           docker buildx build --platform linux/amd64 \
@@ -79,6 +85,18 @@ jobs:
             --push .
         env:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Build and push UI
+        run: |
+          docker buildx build --platform linux/amd64 \
+            -f ui/Dockerfile \
+            -t gitea.siegeln.net/cameleer/cameleer3-server-ui:${{ github.sha }} \
+            -t gitea.siegeln.net/cameleer/cameleer3-server-ui:latest \
+            --cache-from type=registry,ref=gitea.siegeln.net/cameleer/cameleer3-server-ui:buildcache \
+            --cache-to type=registry,ref=gitea.siegeln.net/cameleer/cameleer3-server-ui:buildcache,mode=max \
+            --provenance=false \
+            --push ui/
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
       - name: Cleanup local Docker
         run: docker system prune -af --filter "until=24h"
         if: always()
@@ -88,14 +106,16 @@ jobs:
           API="https://gitea.siegeln.net/api/v1"
           AUTH="Authorization: token ${REGISTRY_TOKEN}"
           CURRENT_SHA="${{ github.sha }}"
-          curl -sf -H "$AUTH" "$API/packages/cameleer/container/cameleer3-server" | \
-            jq -r '.[] | "\(.id) \(.version)"' | \
-            while read id version; do
-              if [ "$version" != "latest" ] && [ "$version" != "$CURRENT_SHA" ]; then
-                echo "Deleting old image tag: $version"
-                curl -sf -X DELETE -H "$AUTH" "$API/packages/cameleer/container/cameleer3-server/$version"
-              fi
-            done
+          for PKG in cameleer3-server cameleer3-server-ui; do
+            curl -sf -H "$AUTH" "$API/packages/cameleer/container/$PKG" | \
+              jq -r '.[] | "\(.id) \(.version)"' | \
+              while read id version; do
+                if [ "$version" != "latest" ] && [ "$version" != "$CURRENT_SHA" ]; then
+                  echo "Deleting old image tag: $PKG:$version"
+                  curl -sf -X DELETE -H "$AUTH" "$API/packages/cameleer/container/$PKG/$version"
+                fi
+              done
+          done
         env:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         if: always()
@@ -132,6 +152,8 @@ jobs:
           kubectl create secret generic cameleer-auth \
             --namespace=cameleer \
             --from-literal=CAMELEER_AUTH_TOKEN="$CAMELEER_AUTH_TOKEN" \
+            --from-literal=CAMELEER_UI_USER="${CAMELEER_UI_USER:-admin}" \
+            --from-literal=CAMELEER_UI_PASSWORD="${CAMELEER_UI_PASSWORD:-admin}" \
             --dry-run=client -o yaml | kubectl apply -f -
 
           kubectl create secret generic clickhouse-credentials \
@@ -147,8 +169,15 @@ jobs:
           kubectl -n cameleer set image deployment/cameleer3-server \
             server=gitea.siegeln.net/cameleer/cameleer3-server:${{ github.sha }}
           kubectl -n cameleer rollout status deployment/cameleer3-server --timeout=120s
+
+          kubectl apply -f deploy/ui.yaml
+          kubectl -n cameleer set image deployment/cameleer3-ui \
+            ui=gitea.siegeln.net/cameleer/cameleer3-server-ui:${{ github.sha }}
+          kubectl -n cameleer rollout status deployment/cameleer3-ui --timeout=120s
         env:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
           CAMELEER_AUTH_TOKEN: ${{ secrets.CAMELEER_AUTH_TOKEN }}
+          CAMELEER_UI_USER: ${{ secrets.CAMELEER_UI_USER }}
+          CAMELEER_UI_PASSWORD: ${{ secrets.CAMELEER_UI_PASSWORD }}
           CLICKHOUSE_USER: ${{ secrets.CLICKHOUSE_USER }}
           CLICKHOUSE_PASSWORD: ${{ secrets.CLICKHOUSE_PASSWORD }}