[*] cut allocations in `PrometheusWriter.WritePromMetrics` (#1550)

Everything that does not depend on the row is now computed once per
envelope instead of once per row x field:

- fqName and the gauge/counter decision are memoized per field, and the
  namespace prefix is concatenated once instead of via fmt.Sprintf;
- prometheus.Desc is cached per (fqName, label keys). NewDesc allocates
  ~6+2N objects and runs regexp validation and two sorts on every call;
- numeric columns are converted with a direct float64(t) conversion
  instead of strconv.ParseFloat(fmt.Sprintf("%v", v)); only float32
  values may differ at the ULP level;
- the dead labels map allocation and the map[bool]float64 literal are
gone.

BenchmarkWritePromMetrics (500 rows, 3 tags, 8 columns):
  before  10.5 ms/op   5.14 MB/op   141k allocs/op
  after    6.3 ms/op   3.70 MB/op    86k allocs/op

[+] bump `sirupsen/logrus` from 1.9.4 to 1.10.0 (#1524)

[-] use random JWT secret instead of hardcoded key (#1475)

The Web UI/API signed and validated all JWTs with a hardcoded key
published in the source, letting anyone forge accepted tokens and
bypass authentication.

Generate a random 32-byte HS256 key at startup via `crypto/rand`.
Tokens now rotate on every restart, invalidating leaked ones.

[-] use random JWT secret instead of hardcoded key (#1475)

The Web UI/API signed and validated all JWTs with a hardcoded key
published in the source, letting anyone forge accepted tokens and
bypass authentication.

Generate a random 32-byte HS256 key at startup via `crypto/rand`.
Tokens now rotate on every restart, invalidating leaked ones.

[+] bump `go.etcd.io/etcd/client/v3` from 3.6.10 to 3.6.11 (#1387)

* Bump go.etcd.io/etcd/client/v3 from 3.6.10 to 3.6.11

Bumps [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) from 3.6.10 to 3.6.11.
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.6.10...v3.6.11)

---
updated-dependencies:
- dependency-name: go.etcd.io/etcd/client/v3
  dependency-version: 3.6.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* add node_modules to golangci-lint exclusions

* bump github.com/shirou/gopsutil/v4 to 4.26.4

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pavlo Golub <pavlo.golub@gmail.com>

[+] improve invalid metric reporting, closes #1125 (#1306)

---------

Co-authored-by: Pavlo Golub <pavlo.golub@gmail.com>

[!] upgrade core webui dependencies (#1237)

- bump @mui/* packages to v6
- bump @tanstack/react-query to v5.75.0
- bump eslint to v9 and migrate to flat config format
- bump typescript to v5.7
- update form and resolver libraries

[!] bump Go to v1.26 (#1207)

* bump Go to v1.26

* remove `greenteagc` option

* fix new `url.Parse()` behavior

`net/url.Parse()` now rejects malformed URLs containing colons in the
host subcomponent

[+] apply admin functions migrations for v5, fixes #1180 (#1181)

* Apply admin functions migrations for v5

* drop function `ensure_partition_metric_dbname_time` in v5 migration

for easier migration from v4.0.0 => v5.0.0

* Fix use `,` not `;`

* make linter happy

* fix tests

* make linter happy

* bump `sinkSchema` to the latest version

---------

Co-authored-by: Pavlo Golub <pavlo.golub@gmail.com>

[*] fix column names in `Query Performance Analysis` dashboard (#1041)