Add a JSON-RPC stats endpoint for websites

Plain HTTP + JSON-RPC 2.0 (axum, already in the tree) so a site backend
can pull stats without gRPC stubs. Methods: stats.get (counters + gauges)
and stats.channel { channel } (lines + top talkers). Optional [jsonrpc]
config, off unless set.

Security: bearer-token authenticated with a constant-time compare, refuses
to start with an empty token, read-only (only stats.* methods — no way to
mutate state), method-allowlisted, a 64 KiB body limit, and meant to bind
to localhost beside the backend.

src/engine/mod.rs

@@ -201,6 +201,11 @@ impl Engine {
         self.network.bump(key);
     }
 
+    // Per-channel activity (lines + top talkers) for the stats APIs.
+    pub fn channel_activity(&self, channel: &str) -> Option<(u64, Vec<(String, u64)>)> {
+        self.network.channel_activity(channel)
+    }
+
     // The shared counters plus live gauges derived from the store, for the gRPC
     // Stats API. Any service's counters ride in here alongside these.
     pub fn stats_snapshot(&self) -> std::collections::BTreeMap<String, u64> {