Operator dashboard: deployment-wide usage, protected by a separate ADMIN_TOKEN secret

Authorization: Bearer <ADMIN_TOKEN>, a secret distinct from every customer API key, never accepted as one. Totals for 24h/7d/30d (calls, unique key labels, anonymous calls), a 30-day daily series, breakdowns by endpoint, tier and status class, the top 20 key labels by calls, p50/p95 latency and the overall error rate, and an unmet-requests report: per request shape the service cannot fully serve, requests, distinct callers (keyed, paid, repeat), endpoints and a ranking score over 30 days — counts of shapes, never the strings. JSON by default; Accept: text/html or ?format=html returns a small self-contained HTML dashboard with inline SVG bar charts, no external assets.