docs(config): add dashboard statistics examples

base/pref.example.ini

@@ -175,6 +175,16 @@ flush_interval=5
 ;none records all countries as unknown.
 geo_provider=header
 country_headers=CF-IPCountry,X-Geo-Country,X-Vercel-IP-Country,CloudFront-Viewer-Country
+;Optional Basic authentication for /dashboard and /dashboard/data.
+;Only applies when statistics enabled=true.
+;Missing or false keeps the dashboard password disabled.
+dashboard_auth_enabled=false
+dashboard_auth_username=
+dashboard_auth_password=
+;Failed login attempts allowed within dashboard_auth_window_seconds before lock applies.
+dashboard_auth_max_failures=5
+dashboard_auth_window_seconds=300
+dashboard_auth_lock_seconds=900
 
 [emojis]
 add_emoji=false

base/pref.example.toml

@@ -198,6 +198,18 @@ flush_interval = 5
 provider = "header"
 country_headers = ["CF-IPCountry", "X-Geo-Country", "X-Vercel-IP-Country", "CloudFront-Viewer-Country"]
 
+[statistics.dashboard_auth]
+# Optional Basic authentication for /dashboard and /dashboard/data.
+# Only applies when statistics.enabled is true.
+# Missing or false keeps the dashboard password disabled.
+enabled = false
+username = ""
+password = ""
+# Failed login attempts allowed within window_seconds before lock_seconds applies.
+max_failures = 5
+window_seconds = 300
+lock_seconds = 900
+
 [emojis]
 add_emoji = false
 remove_old_emoji = true

base/pref.example.yml

@@ -95,6 +95,17 @@ statistics:
     # none records all countries as unknown.
     provider: header
     country_headers: ["CF-IPCountry", "X-Geo-Country", "X-Vercel-IP-Country", "CloudFront-Viewer-Country"]
+  dashboard_auth:
+    # Optional Basic authentication for /dashboard and /dashboard/data.
+    # Only applies when statistics.enabled is true.
+    # Missing or false keeps the dashboard password disabled.
+    enabled: false
+    username: ""
+    password: ""
+    # Failed login attempts allowed within window_seconds before lock_seconds applies.
+    max_failures: 5
+    window_seconds: 300
+    lock_seconds: 900
 
 emojis:
   add_emoji: false