Add ISAC system metrics

docs/DESIGN_SYSTEM.md

@@ -230,6 +230,14 @@ Use the spacing tokens for new components. Prefer `8px`, `12px`, and `20px` gaps
   before-snapshot; newer work blocks the operation. Successful reversions append
   a new `audit.reverted` event and never alter the original history. `audit.view`
   remains read-only; `audit.revert` is independently assigned.
+- System Metrics is the second read-only System Oversight surface. It uses a
+  compact KPI row for headline process health and a two-column grid of dense
+  runtime, host, database, and service-volume panels. Refresh is explicit and
+  duplicate-safe; optional auto-refresh is visibly selected and uses a
+  restrained ten-second interval. Metrics must not expose environment values,
+  credentials, full filesystem paths, or other deployment secrets. The
+  `metrics.view` permission is independent of mutation access and is included
+  in the read-only Auditor role.
 - Account deletion uses a collapsed danger zone, explicit identity confirmation,
   and plain-language retention guidance. Soft-deleted accounts retain authored
   content under a deleted-agent identity while releasing credentials, usernames,

docs/architecture.md

@@ -113,3 +113,20 @@ Unsupported destructive identity operations, account deletion, incomplete
 snapshots, stale targets, and events whose dependencies no longer exist are
 marked non-reversible or rejected. Recovery for those cases requires a
 specialized workflow rather than inferred database writes.
+
+# System metrics
+
+The read-only `/admin/metrics` route requires `metrics.view` and collects a
+point-in-time process-local health snapshot. Node and operating-system APIs
+provide process CPU and memory, event-loop utilization and delay, host memory,
+load average, core count, platform, and uptime. Embedded Turso pragmas provide
+page allocation, page size, and free-page information; aggregate SQL queries
+provide application record volumes.
+
+The interface refreshes on demand and may poll every ten seconds while the
+operator keeps auto-refresh enabled. CPU and event-loop values are deltas from
+the previous server-side sample, so the first or infrequently requested sample
+is directional rather than a monitoring-grade time series. Production alerting
+and historical analysis should eventually use a dedicated external telemetry
+system. This surface deliberately omits secrets, environment-variable values,
+and full database paths.