the site gets what it needs to boot, and the status stops lying

Three things, and the second is why the panel was confidently wrong.

The site refuses to start without FOFOS_API_TOKEN, ADMIN_SESSION_SECRET,
PUBLIC_URL, API_URL and FOFOS_MEDIA_DIR, and the checkout has no .env at all.
Every one of those is either already known here — the port, the media directory
— or a random secret nobody should be asked to invent. So they are generated
once, kept encrypted under this plugin's own purpose key, and supplied. Once,
not per start: regenerating would invalidate every session and token anybody had
noted down.

pm2 saying `online` is NOT the site being up. `bun --hot` survives a crash at
startup — the process stays alive, pm2 reports online, and nothing is listening.
That is precisely what development did: reported up, served nothing, and this
panel repeated it. The status now also asks whether the port answers, any
response counting, and says "not answering" out loud when the two disagree.

And the buttons are a fixed width, because Start and Restart are different
lengths and rows that size to their own label leave the inputs on different
vertical lines.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

db/schema.ts

@@ -155,6 +155,21 @@ export const fofosAdminSettings = pgTable('fofos_admin_settings', {
   devPort: integer('dev_port'),
   prodPort: integer('prod_port'),
 
+  /**
+   * Secrets the SITE needs at boot, generated here on first start and kept.
+   *
+   * `FOFOS_API_TOKEN` guards the site's own admin API — the one this plugin will call — and
+   * `ADMIN_SESSION_SECRET` signs its sessions. Both are required before the site will serve a request,
+   * and neither is a decision anybody wants to make: they are long random strings, and asking somebody
+   * to invent one is asking them to invent a worse one.
+   *
+   * Encrypted with `encryptSecret('fofos-admin', …)` — its own purpose key, so a leak of that one opens
+   * these and nothing else. Generated once and reused, because regenerating on every start would
+   * invalidate every session and every token anybody had noted down.
+   */
+  siteApiToken: text('site_api_token'),
+  siteSessionSecret: text('site_session_secret'),
+
   /**
    * When the last one finished, which is what makes the schedule survive a restart.
    *