feat(ui): phase 5 — graphs, widgets, theming, PWA, boards, i18n

P5a: 24h uptime bar strip + latency chart on monitor detail, iframe
embed widget, generic JSON-path widget, accent/wallpaper/custom CSS
settings, PWA manifest + service worker, demo GIF.

P5b: transport picker + per-transport fields + test button in
settings; per-monitor alert-rule fields in dialogs.

P5c: container cpu/mem columns, SMART/ZFS/GPU sections on system
detail, subdomains section on domain detail.

P5d: login/setup page + auth middleware client handling, board
switcher + /b/:slug routes, full string extraction to typed t() keys
with {param} interpolation, complete cs locale, language select.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/frontend/src/widgets/embed.tsx

@@ -0,0 +1,23 @@
+import type { Item } from "@/types";
+import { cfgStr } from "@/widgets/index";
+import { t } from "@/i18n";
+
+// Embed — sandboxed iframe. Fully client-side; the tile chrome still shows
+// the item name above the frame.
+export function EmbedWidget({ item }: { item: Item }) {
+	const url = cfgStr(item, "url");
+	// Block script-capable schemes; http(s)/relative URLs are fine.
+	const bad = /^\s*(javascript|data|vbscript|file):/i.test(url);
+	if (!url || bad) {
+		return <span className="text-[11px] text-text-faint">{t("widget.embedHint")}</span>;
+	}
+	return (
+		<iframe
+			src={url}
+			title={item.name || "embed"}
+			sandbox="allow-scripts allow-same-origin allow-forms"
+			referrerPolicy="no-referrer"
+			className="pointer-events-auto h-full min-h-[120px] w-full rounded-[6px] border border-border bg-bg"
+		/>
+	);
+}