Show what each proxy host is actually doing, and mark the ones behind Authelia

NPM writes an access log per host and counts nothing, so 475 MB of logs held the only answer to
"is anything using this". Aggregated on a schedule and read from a few kB of JSON; the row also
now says whether an auth_request block is in front of the site, which nothing showed before.

Plugin/unraid/api/auth.php

@@ -102,7 +102,7 @@ require_once dirname(__DIR__) . '/include/auth.php';
 // panels every stack carries rather than gated to one.
 const VV_AUTH_ACTION_PANEL = [
     // GET
-    'npm_proxies'  => 'proxies', 'npm_certs' => 'proxies',
+    'npm_proxies'  => 'proxies', 'npm_certs' => 'proxies', 'npm_stats' => 'proxies',
     'lldap_users'  => 'users',   'lldap_groups' => 'users', 'lldap_avatar' => 'users',
     'authelia_rules' => 'acl',
     // POST
@@ -150,6 +150,17 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         exit;
     }
 
+    // Per-host request and byte totals, written by Tools/npm_access_stats.sh. Served rather than
+    // computed: the logs behind these numbers are 475 MB and reading them is a scheduled job, not
+    // something a page load can do.
+    if ($action === 'npm_stats') {
+        $f = rtrim(defined('DB_DIR') ? DB_DIR : (DATA_DIR . '/db'), '/') . '/npm_access.json';
+        $s = is_file($f) ? (json_decode((string) @file_get_contents($f), true) ?: []) : [];
+        echo json_encode(['ok' => true, 'hosts' => $s['hosts'] ?? [],
+                          'last_pass' => $s['last_pass'] ?? null]);
+        exit;
+    }
+
     $result = match ($action) {
         'npm_proxies'    => vv_npm_list_proxies(),
         'npm_certs'      => ['ok' => true, 'certs' => vv_npm_list_certs()],