Add LAMP web dashboard: bot→MySQL publisher, PHP API, numbers-only page

- webapp/: deployable LAMP app for /var/www/ — ingest.php (token-gated
  writes), api.php (public read-only), schema.sql (live_price +
  signal_reports), vanilla-JS dashboard with plain-English indicator
  readings, .htaccess, deploy README
- web_publisher.py: fire-and-forget publisher (bounded queue + daemon
  thread) with plain-English payload builder; public API contractually
  never raises; disabled unless WEBAPP_INGEST_URL/TOKEN are set
- telegram_bot.py: publish hooks (tick in WS loop, report in
  _update_level_cache); _candle_loop per-iteration guard so a failing
  scan can never kill an auto-scan loop; quiet heartbeat teardown
- test_all.py: Module 13 — 6 resilience tests (never-raise contract,
  worker survival, candle-loop survival); suite 189/189
- .gitignore: webapp/config.php (server-side secrets)

Verified end-to-end on a scratch MariaDB 10.11 + PHP 8.3 built-in
server incl. headless-Firefox render of the live page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KYNEHBuwwy6sgRM9f9sPx5

webapp/config.sample.php

@@ -0,0 +1,19 @@
+<?php
+// ForexBot2 dashboard config — copy to config.php on the server and edit.
+//   cp config.sample.php config.php
+// config.php is denied to web clients by .htaccess; keep it out of git.
+
+return [
+    // PDO MySQL connection
+    'db_dsn'  => 'mysql:host=127.0.0.1;dbname=forexbot_web;charset=utf8mb4',
+    'db_user' => 'forexbot',
+    'db_pass' => 'CHANGE-ME',
+
+    // Shared secret for ingest.php. Must equal the bot's
+    // WEBAPP_INGEST_TOKEN environment variable. Generate with:
+    //   openssl rand -hex 32
+    'ingest_token' => 'CHANGE-ME-TOO',
+
+    // Symbols the public API will serve (whitelist).
+    'symbols' => ['XAU/USD'],
+];