Dashboard token usage and response inspection; fix Docker CI smoke

The dashboard now answers "where did my tokens go" without opening the log:
totals, per-provider and per-model breakdown, and cache hits shown as the
requests that cost nothing. Each log row expands to the actual prompt and
response, truncated to keep the ring buffer flat.

CI's Docker smoke step supplied no virtual keys, so the container correctly
refused to bind 0.0.0.0 and the job failed. The failsafe was right and the
workflow was wrong; it now supplies keys and additionally asserts that an
unauthenticated call gets 401 and an inference key gets 403 on /api, so an
image that lost its auth boundaries cannot be published green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/core/src/config.ts

@@ -98,6 +98,8 @@ export function parseConfig(raw: unknown, env: Record<string, string | undefined
       const known = new Set(Object.keys(DEFAULT_CONFIG));
       known.add('$schema');
       for (const k of Object.keys(raw)) {
+        // JSON has no comments, so `"//note": [...]` is the conventional stand-in.
+        if (k.startsWith('//')) continue;
         if (!known.has(k)) issues.push({ path: k, message: 'unknown option (ignored)' });
       }