#522 Fix admin dashboard statistics returning zero counts

[Agaki00]

Description

Summary

• Query real counts for users, streams, active streams, and events from the last 24 hours.
• Inject PG_POOL into AdminStatsService with database error handling.
• Add integration coverage for active/inactive streams and event time filtering.
• Update the Swagger description for GET /admin/stats.
• Preserve the existing 60-second controller cache behavior.

Testing

• Workspace diagnostics pass.
• git diff --check passes.
• Typecheck and integration tests could not run because dependencies were unavailable in the environment.

Observation

Why API and app fail
Both images are built from node:20-alpine:

• api/Dockerfile
• app/Dockerfile
• xstreamroll-processing/Dockerfile
  node:20-alpine is a small Alpine-based runtime and is prone to OS-level CVEs in the underlying Alpine packages. Trivy is flagging them as critical in the api and app images, while processing is currently clean enough to pass.

So the pattern fits:

• Filesystem scan: passed
• API image scan: failed on critical package vulnerability
• App image scan: failed on critical package vulnerability
• Processing image scan: passed

This is not “the app code is broken.” It is a base-image/container security gate.

The fix is may be usually one of these:

1. Upgrade the base image to a newer patched Node tag
2. Switch away from Alpine to a newer Debian-based runtime if the vulnerability remains
3. Add a triaged suppression in .trivyignore only if the finding is accepted as a false positive or an intentional risk

Closes #522

[Xhristin3]

LGTM