[ExeQue]

Adds Umami, the privacy-focused web analytics tool, as a preset.

How it runs

• Database: depends on the lerd postgres service. The Umami image cannot create its own database, so it uses lerd's default lerd database with its own schema (?schema=umami), which Prisma creates during the migrations it runs on boot. No manual step needed.
• Domain: domain: umami is declared like rustfs's, because the tracker script is loaded by the browser from a site's own HTTPS origin, where localhost:3002 would be blocked as mixed content. As far as I can read AdoptDefaultServiceDomains, though, lerd only adopts a preset's domain for the built-in default presets. For now it has to be set by hand with lerd service domain umami umami.test. The field is kept so the domain applies once lerd adopts it for store presets too.
• Embedding: Umami sends frame-ancestors 'self' by default, which stops the lerd UI from embedding the dashboard. ALLOWED_FRAME_URLS adds the lerd UI origins.
• .env: following the rustfs pattern, UMAMI_SCRIPT_URL points at the domain (for the browser) and UMAMI_API_URL at the container (for the app), with env_detect on UMAMI_SCRIPT_URL.
• Image: pinned to ghcr.io/umami-software/umami:3.4.
• Login: admin / umami (Umami's default). It is in the description, and the Env tab shows it through env_vars.

Not included

• Auto-login via dashboard_login: that needs dashboard_proxy, and Umami's BASE_PATH is baked in at build time, so the stock image cannot be served under /_svc/umami/.

Checks

• test_render_schema.py, render_schema.py and readme_logos.py were run, and their output is committed.
• schema_guard.py passes against main.
• Tested locally on lerd 1.37.1 (WSL2): migrations apply, https://umami.test/script.js returns 200 from the host and from the PHP-FPM container, CORS preflight from a .test site returns 204, and the CSP returned by Umami lists the lerd UI origins in frame-ancestors, and the dashboard embeds in the lerd UI.