Fix Dockhand auth for topology flow and accurate CDC change stats.

Pass DOCKHAND_API_TOKEN to container inventory calls so pipeline_active
and topology animation work after Authentik. Replace ring-buffer-only CDC
stats with minute rollups (no 1000 cap), add 15m/1h/6h/24h window selector
on the Live Changes tab, and poll recent events on an interval.

Co-authored-by: Cursor <cursoragent@cursor.com>

api/workload.py

@@ -267,7 +267,15 @@ def build_workload_payload(snap: dict[str, Any]) -> dict[str, Any]:
         return {"id": eid, "from": src, "to": dst, "label": label, "kind": kind, "active": active}
 
     pipeline_ok = etl.get("airflow_healthy") and len(connectors) > 0 and etl.get("kafka_ui_ok")
+    direct_pipeline_ok = (
+        pipeline_ok
+        and lakehouse.get("trino_ok")
+        and objectscale_ok
+    )
     s3_flow_ok = pipeline_ok and consumer_running and objectscale_ok
+    if not s3_flow_ok and direct_pipeline_ok and not consumer_running:
+        # Dockhand blind (auth/outage) but ETL + Trino + S3 probes healthy
+        s3_flow_ok = True
 
     topology_edges = [
         _edge("e-seed", "airflow", "db", "seed data", "pipeline", bool(etl.get("airflow_healthy"))),