feat: add emoji reactions, light/dark themes and rollout observability

Add a set of guest-facing and operator-facing features that make the
deployment-strategy demos (recreate, rolling, canary) more visual:

- Emoji reactions (heart/tada/thumbsup/smile): visitors react without an
  account, a first-party cookie keeps counts honest, the tally streams
  live to every tab over SSE. Backed by a new reactions table with an
  idempotent upsert; whitelisted emoji so the endpoint can't be abused.
- Light & dark themes: the wall follows the OS preference, visitors can
  toggle it (persisted locally), and a moderator can force a theme for
  everyone from the admin console, pushed live over SSE.
- Per-replica request counter: a middleware tallies requests answered by
  each replica; surfaced in /healthz, /api/info and the admin replica
  table. Under load-balancing the counts diverge, and a rolling update
  resets them one container at a time — the rollout made visible.
- Rolling-update wave in the Chaos lab: bounces replicas one at a time
  (via the crash endpoint) while polling the replica table, so a training
  session can watch each replica reset and rejoin — what a rolling update
  looks like from the inside.
- Admin console: reactions tile, per-replica Requests column, reaction
  tallies in moderation, and a wall-theme setting.
- Favicon + /favicon.ico redirect.

Tests cover reactions (idempotency, tallies, whitelist) and the theme
setting round-trip.

Akili-Task: tsk_xgg6sfuzkzymyc6gstr4
Akili-Agent: goldfish

.env.example

@@ -45,13 +45,17 @@ DATABASE_URL=postgres://postgres:postgres@db:5432/guestbook?sslmode=disable
 # REDIS_URL=redis://redis:6379
 
 # === Admin console =================
-# Enables /admin. Store as a secret. Generate with: openssl rand -hex 16
+# Enables /admin: overview (stats, replicas with per-replica request counters),
+# moderation (pin / hide / delete, reaction tallies, CSV export) and wall
+# settings (pause signing, banner, forced light/dark theme).
+# Store the token as a secret. Generate with: openssl rand -hex 16
 # ADMIN_TOKEN=
 
 # CIDRs whose X-Forwarded-For is trusted for the signer IP shown in /admin.
 # Unset trusts the header as-is (fine behind the Miabi gateway).
 # TRUSTED_PROXIES=10.0.0.0/8
 
-# Expose /api/debug/* failure injection (crash, slow, 5xx, CPU, memory, logs).
-# Still requires admin auth. Demo environments only.
+# Expose /api/debug/* failure injection (crash, slow, 5xx, CPU, memory, logs)
+# and the admin "rolling-update wave" tool. Still requires admin auth.
+# Demo environments only.
 # DEBUG_ENDPOINTS=false