feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

internal/webapp/constants.go

@@ -0,0 +1,47 @@
+package webapp
+
+// Audit constants used across the webapp audit-log writes. They
+// live in their own file so goconst sees them as named values
+// rather than scattered string literals.
+const (
+	auditActorLocal       = "operator"
+	auditRoleAdmin        = "admin"
+	auditAuthModeLocal    = "local"
+	auditAuthModeBasic    = "basic_auth"
+	auditTargetSelf       = "self"
+	auditActionLogin      = "login"
+	auditActionLoginFail  = "login_failed"
+	auditActionLogout     = "logout"
+	auditActionPassChange = "password_change"
+)
+
+// Inventory source labels. Phase 1 only emits "process"; Phase 3
+// adds "compose" and "docker".
+const (
+	inventorySourceProcess = "process"
+)
+
+// Environment variable names referenced by ConfigFromEnv. Lifted out
+// so the validator and the cmd binary share the same constants.
+const (
+	envWorkerHost        = "WORKER_HOST"
+	envWorkerPort        = "WORKER_PORT"
+	envWorkerURL         = "WORKER_URL"
+	envWorkerLogin       = "WORKER_LOGIN"
+	envWorkerPassword    = "WORKER_PASSWORD"
+	envClusterEnabled    = "WORKER_CLUSTER_ENABLED"
+	envClusterDebugApply = "WORKER_CLUSTER_DEBUG_APPLY"
+	envReleaseURL        = "WORKER_RELEASE_URL"
+)
+
+// Route paths used as redirect targets. Lifted out so goconst stops
+// flagging the duplicates across handlers.
+const (
+	pathOverview       = "/overview"
+	pathChangePassword = "/web/change-password"
+	pathLogin          = "/web/login"
+)
+
+// basicAuthRealm is the value returned in the WWW-Authenticate
+// header. Fixed string so scripted callers can match on it.
+const basicAuthRealm = `Basic realm="rsmon-worker"`