Manage frontend vendors with npm and use Chart.js

README.md

@@ -8,7 +8,7 @@
 - One heuristic profile per log source, so different applications can have different rules while sharing the same OPNsense destination alias.
 - Persistent SQLite state for events, IP states, investigations, decisions, backend actions, and source offsets.
 - Lightweight web UI with a Pi-hole-style dashboard, source-colored activity charts, split bot/non-bot leaderboards, a paginated requests log with collapsible filters and clickable column sorting, IP detail pages, decision history, and full request history per address.
-- The requests log ships with vendored Tabulator assets served locally by the daemon, so the UI stays self-contained and does not depend on a CDN.
+- The dashboard and requests log ship with npm-managed vendored Chart.js and Tabulator assets served locally by the daemon, so the UI stays self-contained and does not depend on a CDN.
 - Background investigation workers that fill in missing cached intelligence without slowing down page loads.
 - Manual `Block`, `Unblock`, `Clear override`, and `Refresh investigation` actions from the UI or the HTTP API.
 - Optional OPNsense integration; the daemon also works in review-only mode.
@@ -152,6 +152,15 @@ Key ideas:
 
 ## Development
 
+Frontend third-party assets are managed with npm and then vendored into `internal/web/assets/`:
+
+```bash
+npm install
+npm run vendor:sync
+```
+
+This refreshes the locally served Chart.js and Tabulator files from `node_modules/`.
+
 Run the test suite:
 
 ```bash