feat: align console with observability demo

.gitignore

@@ -55,3 +55,6 @@ package-lock.json
 /task_plan.md
 /findings.md
 /progress.md
+
+# Local worktrees
+/.worktrees/

README.md

@@ -31,7 +31,7 @@ LiveForge is a modular live streaming media server that ingests, transmuxes, and
 | 📡 | **GB28181 video surveillance** | Full SIP signaling stack, device registration, live invite, playback, PTZ control, alarm handling — plus a built-in device simulator for testing |
 | 🌐 | **Multi-protocol cluster** | Origin-edge cascading via RTMP / SRT / RTSP / RTP / GB28181 with HTTP scheduler callback for dynamic topology |
 | ⚡ | **LL-HLS** | Low-Latency HLS with fMP4 partial segments, blocking playlist reload (`_HLS_msn`/`_HLS_part`), and delta playlist updates |
-| 🖥️ | **Web console** | Permission-aware tabs for Streams, GB28181, Config, Cluster, SIP Calls, Storage, and Security; Recent Audit is inside Security; grouped as Workspace, Operations, and System so Config/Security are not peer stream pages; includes browser preview/publish |
+| 🖥️ | **Web console** | Permission-aware tabs for Streams, GB28181, Config, Cluster, SIP Calls, Storage, and Security; Recent Audit is inside Security; grouped as Workspace, Operations, and System; Streams has stable rows with inline four-metric trends; `/console/publish` is a WHIP/SIP/GB28181 broadcaster workspace |
 | 🛡️ | **Production-ready** | Slow consumer protection (EWMA frame dropping), GCC congestion control, per-IP rate limiting, Prometheus metrics |
 
 ## Features
@@ -130,7 +130,7 @@ Apple LL-HLS implementation for sub-second latency HLS delivery:
 
 ### Management & Operations
 
-- **Web console** — Seven permission-aware tabs with multi-protocol preview and WHIP publish: Streams, GB28181, Config, Cluster, SIP Calls, Storage, and Security. Recent Audit is a surface inside Security, not a separate tab.
+- **Web console** — Seven permission-aware tabs with multi-protocol preview and a dedicated `/console/publish` broadcaster workspace. All management views share the dark teal, mint/cyan/amber/coral visual system used by the console direction demo. Streams keeps fixed column tracks, restores a Preview action, and expands the selected row with four compact 60-second trends (bitrate, video FPS, audio FPS, and GOP duration) sampled once per second. The publish workspace selects WHIP/WebRTC, SIP, or GB28181 while preserving the existing protocol-lab lifecycle. Recent Audit is a surface inside Security, not a separate tab.
 - **REST API** — Stream lifecycle, config refresh/status, cluster status, SIP call control, recording/DVR management, security/audit, GB28181, and public health probes
 - **Auth and RBAC** — Named viewer/operator/admin API tokens, console sessions, JWT/callback publish/subscribe auth, bounded redacted audit trail
 - **Recording and DVR** — FLV, fragmented MP4, MP4, MPEG-TS, and HLS recording; new recordings default to fMP4/`.mp4`; every rotated recording file retains the declared tracks and latest codec initialization, starts each track on a zero-based file-local timeline, and remains independently parseable; TS emits PAT/PMT before its first media PES, while classic MP4 calculates audio/video durations on their independent clocks, saturates version-0 timing fields instead of wrapping, uses signed `ctts` version 1 for negative B-frame composition offsets, and writes expandable AAC ESDS lengths; fMP4 declares AAC directly, converts non-AAC source audio such as G.711, Opus, and MP3 to AAC through the optional `audiocodec`/FFmpeg build, and filters audio to keep playable video-only output when that path is unavailable; a stopped transformed recording drains source frames already committed before finalizing, while publisher-generation completion flushes retained resampler samples, pads the final partial PCM frame, and emits delayed encoder packets exactly once before Record/DVR output closes; DVR TS similarly normalizes audio unsupported by its target; segmentation, storage health, download/range/inline-play/delete management, exact full-ID action routing, retryable cleanup-before-primary deletion, zero-byte session protection, and time-shift status. Recording play/download acquire the global connection budget before opening media and apply a 10-second write deadline.

README.zh-CN.md

@@ -33,7 +33,7 @@ LiveForge 是一个模块化的直播流媒体服务器，支持实时音视频
 | 📡 | **GB28181 视频监控** | 完整 SIP 信令栈，设备注册、实时拉流、录像回放、云台控制、报警处理 —— 附带内置设备模拟器 |
 | 🌐 | **多协议集群** | 支持 RTMP / SRT / RTSP / RTP / GB28181 的 Origin-Edge 级联，支持 HTTP 调度回调动态拓扑 |
 | ⚡ | **LL-HLS 低延迟** | fMP4 部分分片、阻塞式播放列表刷新（`_HLS_msn`/`_HLS_part`）、增量播放列表 |
-| 🖥️ | **Web 控制台** | 权限感知标签页依次为 Streams、GB28181、Config、Cluster、SIP Calls、Storage、Security；Recent Audit 位于 Security 内部；按 Workspace、Operations、System 分组，Config/Security 不再与视频流页面平级；支持浏览器预览/推流 |
+| 🖥️ | **Web 控制台** | 权限感知标签页依次为 Streams、GB28181、Config、Cluster、SIP Calls、Storage、Security；Recent Audit 位于 Security 内部；按 Workspace、Operations、System 分组；Streams 提供稳定行和行内四指标趋势；`/console/publish` 是支持 WHIP/SIP/GB28181 的主播工作台 |
 | 🛡️ | **生产级可靠性** | 慢消费者保护（EWMA 丢帧）、GCC 拥塞控制、IP 级限流、Prometheus 监控 |
 
 ## 特性
@@ -132,7 +132,7 @@ Apple LL-HLS 标准实现，亚秒级延迟 HLS 分发：
 
 ### 管理与运维
 
-- **Web 控制台** — 七个权限感知标签页及多协议预览和 WHIP 推流：Streams, GB28181, Config, Cluster, SIP Calls, Storage, and Security。Recent Audit 是 Security 内部的界面，不是单独的第八个标签页。
+- **Web 控制台** — 七个权限感知标签页及多协议预览，并提供独立的 `/console/publish` 主播工作台。所有管理页统一使用 console demo 的深青黑底色与 mint/cyan/amber/coral 色彩系统。Streams 使用固定列宽并恢复 Preview 操作，点击流行会在该行下方展开四张同时显示的紧凑 60 秒趋势图（码率、视频 FPS、音频 FPS、GOP 时长），每秒采样一次。主播工作台可在 WHIP/WebRTC、SIP、GB28181 之间选择协议，并复用现有协议实验室生命周期。Recent Audit 是 Security 内部的界面，不是单独的第八个标签页。
 - **REST API** — 流生命周期、配置刷新/状态、集群状态、SIP 呼叫、录制/DVR、安全/审计、GB28181 和公开健康探针
 - **鉴权与 RBAC** — viewer/operator/admin 命名令牌、控制台会话、推拉流 JWT/回调鉴权，以及有界脱敏审计记录
 - **录制与 DVR** — FLV、FMP4、MP4、MPEG-TS、HLS 录制；新录像默认使用 fMP4/`.mp4`；每个轮转录像文件都会保留已声明轨道和最新 codec 初始化，并让每条轨道从文件内零时间轴开始，确保文件可独立解析；TS 会在首个媒体 PES 前写入 PAT/PMT，经典 MP4 按音视频各自时钟计算 duration、对超出 version-0 表示范围的时间字段做饱和而不回绕、对负 B 帧合成偏移使用有符号 `ctts` version 1，并使用可扩展 AAC ESDS 长度编码；fMP4 仅直接写入 AAC，启用可选 `audiocodec`/FFmpeg 构建时会将 G.711、Opus、MP3 等非 AAC 音频转为 AAC，未启用时过滤音频并保留可播放的纯视频输出；转码录制停止时会先排空停止边界前已经提交的源帧再完成文件，publisher generation 结束时还会先排空重采样滤波器保留的样本，再用静音补齐最后一个不完整 PCM 帧，并在 Record/DVR 输出关闭前仅一次排空编码器延迟包；DVR TS 同样会将目标不支持的音频统一转换；支持分段、存储健康、下载/Range/在线预览/删除管理、精确完整 ID 操作路由、清理失败后可重试且最后删除主文件、零字节会话保护和时移状态。录制在线预览/下载会在打开媒体前占用全局连接配额，并设置 10 秒写期限。

agent-manifest.json

@@ -160,6 +160,12 @@
     "audit": "bounded in-memory entries plus structured logs with secret metadata redaction",
     "production_requirements": ["Change console credentials", "Enable TLS", "Enable API and stream authentication", "Restrict exposed ports", "Configure rate limits"]
   },
+  "console_observability": {
+    "publish_route": "/console/publish",
+    "publish_protocols": ["whip", "sip", "gb28181"],
+    "stream_trends": "The Streams Console uses keyed fixed-layout rows, keeps Preview actions, inserts detail directly after the selected row, and samples bitrate, video FPS, audio FPS, and GOP duration once per second with at most 60 samples rendered as simultaneous inline SVG charts.",
+    "visual_system": "All management views share the console direction demo's dark teal surfaces with mint, cyan, amber, and coral accents; /console/publish uses the same two-column broadcaster workspace layout."
+  },
   "limitations": [
     "There is no current public release until a v* tag completes the release workflow.",
     "The Docker image is only available after the release workflow publishes it.",