Add a JSON-RPC stats endpoint for websites

Plain HTTP + JSON-RPC 2.0 (axum, already in the tree) so a site backend
can pull stats without gRPC stubs. Methods: stats.get (counters + gauges)
and stats.channel { channel } (lines + top talkers). Optional [jsonrpc]
config, off unless set.

Security: bearer-token authenticated with a constant-time compare, refuses
to start with an empty token, read-only (only stats.* methods — no way to
mutate state), method-allowlisted, a 64 KiB body limit, and meant to bind
to localhost beside the backend.

src/main.rs

@@ -5,6 +5,7 @@ mod config;
 mod engine;
 mod gossip;
 mod grpc;
+mod jsonrpc;
 mod link;
 mod proto;
 
@@ -110,6 +111,11 @@ async fn main() -> Result<()> {
         tokio::spawn(grpc::run(engine.clone(), grpc_cfg, gossip_tx));
     }
 
+    // JSON-RPC stats endpoint (plain HTTP), for a website's stats pages.
+    if let Some(jsonrpc_cfg) = cfg.jsonrpc.clone() {
+        tokio::spawn(jsonrpc::run(engine.clone(), jsonrpc_cfg));
+    }
+
     // Periodically fold log churn into a snapshot when it grows past the accounts.
     {
         let engine = engine.clone();