Add frontend error collector, CORS/ingest guards, and static doc routes (Phase 3)

- Add static/otel-rum.js: a framework-free browser script that captures
  uncaught errors, unhandled promise rejections and failed resource loads,
  translating them into OTLP log records POSTed to the existing /v1/logs
  endpoint (source: frontend attribute) so they flow through the same
  history/search/issue pipeline as backend telemetry.
- Add correlation-id support: traceHeaders() (manual) and same-origin
  fetch auto-instrumentation inject a W3C traceparent header, so a
  frontend error and the backend spans it triggered share a trace id and
  can be found together via GET /api/traces/{traceId}.
- Add CORS handling (withCORS in cmd/server/main.go) on the OTLP HTTP
  endpoints, required for any browser-origin POST.
- Add an optional shared ingest key (OTEL_INGEST_KEY, via '?key=' or
  X-Otel-Ingest-Key) and a per-IP rate limit (20 rps/burst 50) on OTLP
  HTTP ingestion, to scope/protect a public endpoint fed by a browser
  script. Verified end-to-end (CORS preflight, cross-origin POST, ingest
  key enforcement, rate limiting) against a running server.
- Serve static/otel-rum.js and agents_example.md as static HTTP routes so
  both the script and the agent instructions doc are fetchable directly
  from the base URL.
- Ignore the separately-cloned otel-ui/ frontend repo (has its own .git;
  not meant to be nested into this repo's history).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/collector/collector.go

@@ -32,6 +32,9 @@ type Collector struct {
 	subMutex     sync.Mutex
 	waitLimiter  *ipRateLimiter
 	issues       *issues.Tracker
+
+	ingestLimiter *ipRateLimiter
+	ingestKey     string
 }
 
 // New creates a new Collector instance.
@@ -45,9 +48,22 @@ func New(broadcaster websocket.Broadcaster, historySize int, store storage.Store
 		// Allow bursts of a few immediate waits, then steady-state ~1 req/sec per IP.
 		waitLimiter: newIPRateLimiter(1, 5),
 		issues:      issues.NewTracker(),
+		// Generous enough for normal exporter batching, but enough to stop a
+		// runaway client (e.g. a frontend error handler that itself throws,
+		// looping) from hammering the collector.
+		ingestLimiter: newIPRateLimiter(20, 50),
 	}
 }
 
+// SetIngestKey configures an optional shared key that HTTP OTLP ingestion
+// (traces/metrics/logs) must present, via a '?key=' query parameter or an
+// 'X-Otel-Ingest-Key' header. An empty key (the default) disables the check.
+// This is meant to scope/rate-limit a public ingest endpoint (e.g. one fed
+// by a browser script), not to provide real authentication.
+func (c *Collector) SetIngestKey(key string) {
+	c.ingestKey = key
+}
+
 // ListIssues returns deduplicated error issues, most recently seen first.
 func (c *Collector) ListIssues(limit int) []issues.Issue {
 	return c.issues.List(limit)