ui: shadcn-ui + React island shells for pages, Redis session store

Rewrite the dashboard, machines, users, dns, and settings pages as thin
Astro shells that mount a matching React island (Dashboard, MachinesPage,
UsersPage, DnsPage, SettingsPage) built on the shadcn-ui component
library. Alpine.js templates in those pages are replaced wholesale;
Alpine still ships as the runtime for the ACL editor's dependencies.

- src/components/ui/*: shadcn primitives (button, card, tabs, select,
  dropdown-menu, avatar, badge, input, switch, separator)
- src/components/{dashboard,dns,machines,settings,users}/*: page-level
  React shells that consume server props from the Astro parent
- src/components/shell/AppShell.tsx: shared chrome (nav, user menu)
- src/lib/utils.ts: shadcn's cn() helper
- src/lib/auth/session-manager.ts: pluggable SessionStore interface with
  Redis (via REDIS_URL) or in-memory backends; both honor absolute
  expiration via TTL. In-memory logs a warning that sessions vanish on
  restart.
- src/lib/auth/oidc-client.ts, oidc-state.ts: shrink OIDC handlers now
  that PKCE + nonce state travels in a signed JWT cookie
- src/pages/api/auth/*: match the simplified handlers
- src/styles/global.css, tailwind.config.mjs, tsconfig.json: shadcn
  design tokens and the '@/*' path alias
- docker-compose.local.yml: local dev tweaks
- package.json, pnpm-lock.yaml: shadcn + Radix + ioredis + zod

src/pages/api/auth/status.ts

@@ -6,10 +6,7 @@
  */
 
 import type { APIRoute } from 'astro';
-import {
-	getActiveSessionCount,
-	getSessionManager,
-} from '../../../lib/auth/session-manager.js';
+import { getSessionManager } from '../../../lib/auth/session-manager.js';
 import {
 	getRoleMappingConfig,
 	loadAuthentikConfig,
@@ -104,7 +101,7 @@ export const GET: APIRoute = async ({ url, cookies }) => {
 		}
 
 		// Get session statistics (simplified for now)
-		const activeSessionCount = getActiveSessionCount();
+		const activeSessionCount = await sessionMgr.getActiveCount();
 
 		const detailedStatus = {
 			...basicStatus,