[windischb]

The dashboard becomes a catalog of widgets on a 12-column grid, with statistics and charts, and an arrangement each user can change.

What it does

• Statistics and charts. Sign-ins per day (successful / failed, 30 days), sign-in methods, security events by severity with the most frequent warnings and errors, counts for the directory and the application surface, four headline numbers. The charts are plain SVG components on the design-system tokens — no chart dependency.
• Three layers of arrangement. A user's own layout, else the realm default an admin set, else the layout built into the app. Widgets can be reordered, resized, removed and added in an edit mode; realm-settings:write can save or remove the realm default.
• Per-widget settings. A placement can carry options: which counts the directory and applications widgets show, how many rows the list widgets show.
• Personal widgets for every signed-in user: account security, own sessions, "My apps" (the clients the account holds a valid authorization with), "My passkeys".

Backend

• GET /api/dashboard/stats — counts plus per-day series, aggregated in SQL and bucketed by the viewer's calendar day. Each block is computed only when the caller holds the permission guarding the matching list surface, and is omitted otherwise.
• GET /api/dashboard/my-apps — strictly the caller's own valid authorizations, one row per client.
• GET/PUT/DELETE /api/dashboard/layout for the caller's own arrangement; PUT/DELETE /api/admin/dashboard/default-layout (realm-settings:write) for the realm default. A layout is shape-checked only and grants nothing: the widget catalog lives in the frontend, and a widget the viewer may not see drops out at render time.
• A permanent erase drops the user's arrangement.

Fixed along the way

The old "failed attempts, 24h" tile read a Level field the security-log endpoint never returned. The number now comes from the statistics endpoint.

Verification

• 15 integration tests in DashboardEndpointsTests (day buckets in the viewer's zone, failure streaks, withheld blocks without permission, per-user layout, realm default gating, options, my-apps).
• Frontend type check; walked through in the browser against a dev database (display, tooltip, dark mode, narrow width, save / reset / realm default, widget settings).
• Not verified: reordering by dragging with a real mouse (only with synthetic drag events; the arrow buttons do the same), and the rendering of "My apps" / "My passkeys" in a browser. The full backend suite was not run locally.

Not in this PR

• The realm default layout is not part of the realm manifest (export / import).
• No documentation page for the dashboard yet.

🤖 Generated with Claude Code