feat: ops & UX batch — jobs survive restarts, logs/system in the console, media queue, gallery, chat, exact stream tokens

Fifteen changes aimed at the first day of real use:

- Import and media jobs persist to <data>/jobs-*.json and reload on start
  (running ones settle as errors); the Register button no longer vanishes
  because the gateway restarted.
- Docker ships the cortiq binary (built in the builder stage) — local .cmf
  chat models and image/video generation now work in containers, where
  auto-install never could (no cargo in the runtime image). libvulkan1 added
  for optional GPU offload.
- Open admin console on 0.0.0.0 without a token now warns in the log and
  shows a dismissible banner — the VPS footgun is at least labeled.
- "Restart gateway" button in Settings: stops managed model servers, spawns
  a fresh copy (bind retried while the port frees), Docker relies on the
  container restart policy instead.
- Dashboard "System" panel: CPU sparkline + load, RAM (with the gateway's
  own RSS), free disk at the models dir — sampled by sysinfo every 2 s.
- Featured model cards warn "not enough disk" / "may not fit in RAM" before
  the download, from the same live snapshot.
- Log viewer in the sidebar: a 500-line in-memory ring fed by a second
  ANSI-free tracing layer; filter, level, pause, copy.
- Update check: crates.io polled twice a day, the console shows an
  "update available" notice.
- Media generations queue up (with position shown) instead of being
  rejected; progress gained an honest ETA from measured throughput.
- Generation gallery under the image/video tabs: lazy PPM thumbnails,
  click to reopen with seed/steps, delete.
- Playground chat is a real dialogue now: history is resent, bubbles,
  Clear, Cmd/Ctrl+Enter.
- "Connect your app" snippets (curl / Python / JS) on the keys page, with
  the real key inlined right after creation.
- One-click benchmark on the Models page via `cortiq bench --json`.
- Config export now downloads the actual gateway.toml (comments intact);
  import accepts TOML (validated, hot-reloaded) and the legacy JSON.
- Streaming token counts are exact when the model server provides usage
  (cortiq-server patch, shipped separately); the gateway fallback now
  counts content chunks (1/token on cortiq) instead of chars/4.

Wizard's Finish lands on the Playground. 37 new strings in all 7 languages.

src/main.rs

@@ -9,11 +9,13 @@
 #![allow(dead_code)]
 
 mod admin;
+mod bench;
 mod cache;
 mod cmf_runtime;
 mod config;
 mod error;
 mod import;
+mod logbuf;
 mod media;
 mod model;
 mod pipeline;
@@ -26,6 +28,7 @@ mod routing;
 mod secrets;
 mod state;
 mod stats;
+mod sysmon;
 
 use axum::{routing::get, Router};
 use clap::Parser;
@@ -204,12 +207,23 @@ async fn main() -> anyhow::Result<()> {
     if listen != original_listen {
         let _ = cfg.save(&config_path);
     }
-    tracing_subscriber::fmt()
-        .with_env_filter(
-            tracing_subscriber::EnvFilter::try_from_default_env()
-                .unwrap_or_else(|_| cfg.log.level.clone().into()),
-        )
-        .init();
+    {
+        use tracing_subscriber::layer::SubscriberExt;
+        use tracing_subscriber::util::SubscriberInitExt;
+        let filter = tracing_subscriber::EnvFilter::try_from_default_env()
+            .unwrap_or_else(|_| cfg.log.level.clone().into());
+        tracing_subscriber::registry()
+            .with(filter)
+            .with(tracing_subscriber::fmt::layer())
+            // second copy of every line, without ANSI, into the in-memory ring
+            // that backs the admin console's Логи view
+            .with(
+                tracing_subscriber::fmt::layer()
+                    .with_ansi(false)
+                    .with_writer(logbuf::RingMakeWriter),
+            )
+            .init();
+    }
 
     let admin_enabled = cfg.admin.enabled;
     let admin_token = resolve_admin_token(&cfg, &args);
@@ -217,6 +231,18 @@ async fn main() -> anyhow::Result<()> {
 
     let state = SharedState::build(cfg, config_path.clone())?;
 
+    // Open admin console reachable from other machines: fine on a laptop,
+    // a footgun on a VPS. Flag it for the UI banner and say it in the log.
+    let host_public = listen.starts_with("0.0.0.0") || listen.starts_with("[::]");
+    if admin_enabled && admin_token.is_empty() && host_public && !is_docker() {
+        state
+            .admin_open_public
+            .store(true, std::sync::atomic::Ordering::Relaxed);
+        tracing::warn!(
+            "admin console is OPEN (no token) and listening on {listen} — anyone on              your network can manage this gateway; set a token via --admin-token or              [admin].token if this machine is reachable from outside"
+        );
+    }
+
     // Close the loop with the CMF format (github.com/infosave2007/cmf): install
     // / update cortiq-cli and run a local `cortiq serve` if configured. Runs in
     // the background so startup is never blocked by a cargo install or a model
@@ -247,7 +273,25 @@ async fn main() -> anyhow::Result<()> {
 
     let app = app.with_state(state).layer(cors);
 
-    let listener = tokio::net::TcpListener::bind(&listen).await?;
+    let listener = {
+        let mut attempt = 0u32;
+        loop {
+            match tokio::net::TcpListener::bind(&listen).await {
+                Ok(l) => break l,
+                Err(e) => {
+                    // during self-restart the old process is still letting go of
+                    // the port — retry for a few seconds before giving up
+                    let retrying = std::env::var("CORTIQ_BIND_RETRY").is_ok();
+                    if retrying && attempt < 50 {
+                        attempt += 1;
+                        tokio::time::sleep(std::time::Duration::from_millis(200)).await;
+                        continue;
+                    }
+                    return Err(e.into());
+                }
+            }
+        }
+    };
     tracing::info!("cortiq-gateway listening on {listen}");
     if admin_enabled {
         let host_for_url = if listen.starts_with("0.0.0.0:") {