Make DNS and Secrets dashboard widgets match the integration widgets

DNS and Secrets each rendered as three separate stat-tile cards plus a
fourth full-width breakdown card -- visually a different family from
the single self-contained card each integration widget uses (label +
status badge, a compact stat row, then its own breakdown bar inline).

Extracted the integration widgets' card shell into a shared WidgetCard
component (label + badge header, children below) and rebuilt DNS and
Secrets on top of it instead of StatTile/TypeBreakdown, which are now
unused and removed. Also refactored the Integrations map itself onto
WidgetCard, so all eight dashboard widgets (DNS, Secrets, and the six
integrations) are now literally the same component, not just visually
similar.

DNS and Secrets get a badge like the integrations' Connected/Not
connected -- "Not configured" (gray) when nothing's set up yet, or a
status summary otherwise ("X enabled" for DNS; "All OK" / "X expiring"
/ "X expired" for Secrets, mirroring how a failing integration shows a
warning-colored count instead of a plain badge). They now sit under
one "Overview" heading in a shared row instead of two separate
sections, matching how the integration widgets already share one
row-cards grid.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -17,14 +17,15 @@ All modules from the original plan are built:
 
 - Monorepo scaffold, Tabler-themed app shell/navigation
 - Authentik OIDC login, roles (first user to sign in becomes admin), audit log
-- **Dashboard** — an overview of every system this app tracks: DNS (domain/
-  record counts per provider, cached records broken down by type), Secrets
-  (monitored/expiring/expired counts, broken down by type), and a widget per
-  integration with a small stat row plus its own breakdown — Tailscale by
-  OS, Proxmox by node (VM/LXC counts too), Dockhand by container state (plus
-  host count), Semaphore and Gitea by last-run status (plus private-repo
-  count), and Synology's CPU/RAM alongside its disk-health breakdown.
-  Breakdowns render as a stacked proportion bar with a legend — no charting
+- **Dashboard** — an overview of every system this app tracks, all sharing
+  one widget-card design (label + status badge, a small stat row, then its
+  own breakdown): DNS (domain/record counts per provider, cached records by
+  type), Secrets (monitored/expiring/expired, by type), and one widget per
+  integration — Tailscale by OS, Proxmox by node (VM/LXC counts too),
+  Dockhand by container state (plus host count), Semaphore and Gitea by
+  last-run status (plus private-repo count), and Synology's CPU/RAM
+  alongside its disk-health breakdown. Breakdowns render as a stacked
+  proportion bar with a legend — no charting
   library, matching the rest of the app's plain-Tabler-CSS approach.
 - **Diagnostic Log** (admin-only) — every call this app makes to a DNS
   provider or integration (Tailscale, Proxmox, Synology, Semaphore, Gitea,