Stable v2.8.3

• docs: fleet dashboard cards + reseller self-service
• refactor(ui): fix real react-hooks findings, downgrade compiler-advisory rules
• fix(packaging): surface frontend build failures instead of swallowing them
• chore(deps): update all npm dependencies to latest
• chore(deps): update all Go modules to latest
• feat(security): remote log forwarding to a SIEM over TLS
• feat(log-forwarding): test-connection probe + auto-push to new servers
• fix(log-forwarding): use StreamDriverPermittedPeers for omfwd TLS pinning
• feat(reseller): subscription provisioning, customer drilldown & self-profile
• feat(dashboard): fleet health + resource hotspots for admin & reseller
• feat(docker): opt-in gVisor isolation per container
• chore(docker-ext): rebuild arm64 backend for 0.1.2
• fix(docker): remove dead disk knob, add reseller container cap, redeploy pre-fill