feat: add traffic investigation workspace and scoped overview

[biancarosa]

The dashboard previously separated traffic inspection from aggregate statistics and lost investigation context when navigating. Traffic is now the landing workspace: filter a host's failures, inspect adjacent requests, visit Overview, and return to the same filters, selection, and evidence snapshot.

Changes

• Traffic / Compose / Overview navigation, retaining the existing history and statistics paths.
• Host, method, outcome, UTC time and URL-search filters; structured scope and request selection in the URL. Free-text search and captures remain in memory.
• Adjustable desktop detail panel with Previous/Next and Request / Response / Timing tabs; full-width detail and Back to results on narrow screens. Explicit missing/expired evidence handling.
• Live/Pause with five-second checks and deliberate application of buffered snapshots. Failed refreshes retain visible evidence and Retry.
• Host/sanitized-path breakdowns and scoped time buckets for retained counts, failure share and p95 time to upstream response headers, with exact-population drill-downs and sample counts.
• In-place Traffic/Overview navigation verified against the Go-served static export, avoiding a full navigation that resets the investigation.

Validation

• Dashboard unit suite: 9 tests, including exact grouping and time-bucket population boundaries, unknown outcomes, empty samples and latency exclusions.
• npx tsc --noEmit, npx eslint src, and npm run build.
• Built and ran the current Go binary serving the production dashboard.
• Browser: host-failure filtering, adjacent request navigation, Traffic → Overview → Traffic scope/selection preservation, buffered live arrival and apply/pause, expired selected link after buffer eviction, and a bucket drilling into exactly four represented requests.
• Visually checked 1280 px desktop split view and 390 px full-width inspection, including focus transfer and return to results.

Scope and limits

This is the roadmap's second deliverable: investigation workspace and monitoring overview. Counts and trends describe retained samples, not a lossless traffic rate or long-term metric store. Paths are sanitized captured paths, not inferred route templates. Latency excludes tunnels and attempts without upstream responses, and does not include streaming body lifetime. Polling/streaming request types remain unclassified; the UI explicitly warns that delayed response headers can affect p95 and provides comparable host/path/method scoping.

URL links preserve scope, not immutable evidence; reloading fetches the current buffer and missing request IDs are explained. Live/Pause affects dashboard checks only. Alert rules, durable incident snapshots and reproduction/comparison are subsequent roadmap work. No merge or deployment is included.

See docs/investigation-workspace.md for semantics and limitations.