Add super/jump admin, per-host connection tracking; move stats to Audit

- app_super_admin (cross-app, also recognized by sso-manager-node/proxy)
  and a new app_jump_admin group are added to conf.auth: super admins are
  full admins here same as app_sso_admin; jump admins get audit page/data
  access without other admin rights (isJumpAdmin/requireJumpAdmin in
  middleware/auth.js, wired into routes/api.js's audit-data gate and the
  /audit page's client-side forceLogin -- previously the page shell
  rendered for any logged-in user, only the data was gated).
- Dashboard: moved the stat boxes and Top hosts/Top users cards to the
  Audit page (audit is now the admin-facing metrics home; dashboard stays
  focused on "hosts I can reach"). Renamed "All hosts" to "My hosts".
- Host list now shows Last connection/Last failed connection columns and
  highlights rows green (live session, from session_registry) or yellow
  (most recent attempt failed) -- backed by new per-host last-success/
  last-fail timestamps in models/metrics.js, populated by ssh_server.js
  (which now attributes grammar/TUI connect failures to the resolved host
  when one was found, not just aggregate counters) and surfaced through
  GET /api/user/hosts (routes/user.js).

nodejs/routes/api.js

@@ -13,7 +13,7 @@ router.use('/user', middleware.auth, require('./user'));
 // admin gate (see routes/api_token.js for why a token can't reach admin routes).
 router.use('/api-token', middleware.auth, require('./api_token'));
 
-// Jump-host data — admin only (audit log, active sessions, metrics).
-router.use('/', middleware.auth, middleware.requireAdmin, require('./jump'));
+// Jump-host data — jump admin only (audit log, active sessions, metrics).
+router.use('/', middleware.auth, middleware.requireJumpAdmin, require('./jump'));
 
 module.exports = router;