A follow-up to the 1.2.0 audit, and the same pattern: things the docs and the
dashboard promise that did not actually happen at runtime. Each fix ships with
a regression test that fails without it.

Dashboard live updates never worked. app.js has always opened an EventSource
against /api/v1/events, but that route was never registered, so the request
fell through to the dashboard catch-all, came back as HTML with a 404, and the
UI stayed frozen on its page-load snapshot while retrying every five seconds.
The endpoint now streams route, container and certificate events from the SSE
hub, which until now was unreachable code. The admin server's 10s WriteTimeout
would have severed that stream, so it is gone as it already was on the HTTP and
HTTPS servers; ReadHeaderTimeout still bounds slow request headers.

A listener that could not bind was logged and then ignored, leaving a process
that announced "DockRouter ready", answered the health probe and served no
traffic at all. A serving error is now fatal: graceful shutdown, exit 1.

/ready reported ready while Docker discovery was down. Start set the engine's
running flag before the initial sync and never rolled it back on failure, so
IsRunning returned true for an engine that had never started and would never
learn about a route.

dr.healthcheck.interval was documented but ignored: every backend was probed on
the checker's single global tick. Each target is now scheduled on its own
interval, falling back to the global default when it declares none.

WebSocket connections leaked a goroutine and two sockets each. The proxy waited
for both copy directions; when a client hung up, the backend-to-client copy
stayed blocked in Read until the backend happened to close, which for an idle
socket is never. Whichever direction ends first now closes both connections.
The upgrade request also dropped every client header outside a fixed handshake
allowlist, including Cookie and Authorization, so any backend authenticating
its WebSocket endpoint rejected the connection. Client headers are forwarded
now, minus hop-by-hop ones; X-Forwarded-For, X-Real-Ip, X-Forwarded-Proto and
X-Forwarded-Host are set from the real connection so a client cannot spoof
them, and a value carrying CRLF is dropped rather than smuggled upstream.

make lint works again: .golangci.yml was still on the v1 schema, which
golangci-lint v2 refuses to load before inspecting a single file, and the
Makefile installed from the v1 module path. Both track v2 now, and the tree is
clean under gofmt -s with zero golangci-lint issues.

Verified: go vet clean, cross-builds for linux/darwin/windows on amd64 and
arm64, full suite green under -race, coverage 92.0% of statements.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R3pJxW4BWZgzgW8MWQWZpN