feat(relay): aggregate anonymous fleet statistics

[frahlg]

What changed

• add POST /fleet for FTW's fixed anonymous daily report
• reduce each valid report to bounded UTC-day counters and keep at most 90 days
• store no raw report or source address
• expose detailed totals only on loopback and return 404 for the public stats path
• keep the encrypted WebSocket route blind and unchanged

Why

The old fleet endpoint is no longer reachable. The existing FTW relay is live and is the right place to receive the small daily report, but it must keep only useful totals and no household log.

Deploy this before the matching FTW Core beta starts sending reports.

Checks

• npm run verify — 879 passed, 1 skipped; 0 Svelte errors or warnings; production build passed
• relay tests cover exact fields, bad widened bodies, rate limits, 90-day retention and bounded labels
• Docker image build, Compose config, Caddy validation and non-root state-volume writes passed locally

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ftw-webapp	26b2b19	Commit Preview URL Branch Preview URL	Aug 13 2026, 07:35 AM

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 08d9320066

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Store label counters without inherited properties

Because Counts values are ordinary {} objects, an accepted public report with drivers: ["constructor"] reads the inherited Object constructor here, converts it to NaN, and persists that value as null. The next relay restart rejects the entire affected day in readDay, losing all of that day's aggregates; __proto__ similarly disappears rather than being counted. Use null-prototype dictionaries or an own-property check before incrementing arbitrary validated labels.

Useful? React with 👍 / 👎.