alot more changes

README.md

@@ -145,6 +145,9 @@ Errors seen in traces (spans with an error status) and logs (severity
   Supports `limit`.
 - `GET /api/issues/{id}` - Fetch a single issue, including up to 5 recent
   sample occurrences (timestamp, trace/span id, message).
+- `GET /api/issues/{id}/sources` - Return every distinct source IP recorded
+  for the issue, with occurrence count and first/last seen timestamps. Requires
+  the ClickHouse occurrence store; returns `501` with file/in-memory storage.
 - `GET /api/issues/{id}/traces` - Every trace the issue occurred in, most
   recently hit first, with each trace's summary and its occurrences, in one
   request (`limit`, `before` = `nextBefore` from the previous page).
@@ -161,8 +164,9 @@ Errors seen in traces (spans with an error status) and logs (severity
 - `GET /api/rollouts/{id}` - Fetch one normalized rollout.
 - `GET /api/rollouts/{id}/impact` - Return optional Prometheus error-rate points
   around the rollout.
-- `POST /api/sourcemaps` - Upload a JavaScript source map. Public multipart upload;
-  the release build script sends the source-map file contents directly.
+- `POST /api/sourcemaps` - Upload a JavaScript source map. Requires the shared
+  `OTEL_SOURCEMAP_KEY` in an `X-Sourcemap-Key` header (uploads are refused while
+  it is unset). Multipart upload;
   multipart fields are `release`, `source` (the generated bundle URL/path),
   and `file`. Uploaded maps are used server-side to resolve frontend stacks.
 
@@ -286,6 +290,7 @@ npm --prefix otel-ui run build
 # Upload after the new UI is deployed. Use the generated URL/path exactly as
 # it appears in browser stack traces.
 curl -fS -X POST https://otel.example.com/api/sourcemaps \
+  -H "X-Sourcemap-Key: $OTEL_SOURCEMAP_KEY" \
   -F "release=$RELEASE" \
   -F "source=/assets/index-ABC123.js" \
   -F "file=@otel-ui/dist/assets/index-ABC123.js.map"
@@ -330,8 +335,21 @@ to Docker or stored in the image.
 
 - `OTELLOG_PATH` - path to the persistent telemetry log file (default
   `otel-agent.log`). Only used when ClickHouse is not configured.
+- `OTEL_SOURCEMAP_KEY` - shared key required to upload source maps.
+- `OTEL_SOURCEMAP_CACHE_MB` - size budget (on-disk MB, default 64) for maps kept
+  parsed in memory; maps are indexed at start and parsed lazily on first use.
 - `OTEL_SOURCEMAP_DIR` - directory for uploaded release source maps (default
   `./sourcemaps`; mount persistent storage there in production).
+- `OTEL_IP_INVESTIGATION_NMAP` - set to `true` to enable the authenticated,
+  rate-limited active service probe. It is off by default because Nmap sends
+  active network traffic to the investigated public IP.
+- `ABUSE_KEY` - optional AbuseIPDB API key. When set, the authenticated IP
+  detail view can check a public address and submit a report without exposing
+  the key to the browser. Keep it in a secret, never in the frontend build.
+- `OTEL_PPROF_ADDR` - address for the Go pprof server (default
+  `127.0.0.1:6060`). It serves `/debug/pprof/` separately from the public UI
+  port; use a port-forward or set this explicitly while diagnosing memory or
+  CPU usage.
 - `OTEL_KUBERNETES_ENABLED` - set to `false` to disable rollout observation;
   otherwise it activates in-cluster or `KUBECONFIG` observation when available.
 - `OTEL_KUBERNETES_NAMESPACE` - optional namespace restriction; empty watches