Viewer RTT telemetry with per-region and trend analytics

[kryptocodes]

Summary

End-to-end viewer-measured tunnel RTT: collection in the viewer, aggregation on the session pod, forwarding at teardown, and analytics in the admin dashboard.

Collection pipeline

• Viewer (kbd/rtt.js, kbd/rtt-report.js): ping probe with per-session jittered cadence (2–8s uniform draw, ~5s mean) so probes decorrelate across sessions; raw samples batched to the proxy with an early first flush (~3s) so sessions killed within seconds still land data. Constrained-link shedding preserved.
• Proxy (proxy/rtstats.go): POST /rtstats ingests batches into a bounded per-session ring and logs cumulative quality lines; GET /rtstats?sid= serves the aggregate for teardown readers.
• Teardown forwarding: ttl-controller reads the pod aggregate before deleting an expired GameServer and POSTs it to the control plane; pool-manager captures it before an explicit kill and returns it on the delete response — no control-plane credentials in the session pod.
• Control plane: POST /sessions/:id/viewer-stats stores the summary on metadata.viewerRtt via an atomic jsonb merge (safe against the concurrent TTL-extend metadata writes).

Analytics

• Viewer RTT KPI in the lifecycle row: fleet p50 with p95 + measured-session coverage.
• Viewer RTT by region card: per-region p50/p95 bars, percentiles computed within each region.
• Viewer RTT trend chart: bucketed p50 line with p95 band, blank buckets where nothing was measured.
• Percentiles are over sessions, not raw samples, so a single chatty session can't dominate.