Rename maglev-frontend → maglevd-frontend; v0.9.1; API RX/TX pulse

Rename the web dashboard binary to maglevd-frontend and move it to
/usr/sbin (it's a daemon and belongs with maglevd). The systemd unit
name stays vpp-maglev-frontend.service since that prefix is the
package name. Manpage, README, user-guide, and debian packaging all
updated in lockstep; bump to 0.9.1 for the first real release.

All frontend env vars are now prefixed MAGLEV_FRONTEND_ so a single
/etc/default/vpp-maglev can be shared with maglevd without collisions.
Every flag has an env equivalent for Docker use. MAGLEV_FRONTEND_USER
and MAGLEV_FRONTEND_PASSWORD still gate the /admin surface.

VPPInfoPanel now pulses "API: ↑↓" indicators in the zippy title
whenever a vpp-api-send / vpp-api-recv log event arrives on the SSE
stream for the scoped maglevd — 250ms blue flash, re-triggerable,
with the two arrows tightly kerned via negative letter-spacing.

debian/vpp-maglev-frontend.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=Maglev web frontend dashboard
-Documentation=man:maglev-frontend(8)
+Documentation=man:maglevd-frontend(8)
 After=network-online.target
 Wants=network-online.target
 
@@ -8,12 +8,13 @@ Wants=network-online.target
 User=maglevd
 Group=maglevd
 EnvironmentFile=/etc/default/vpp-maglev
-ExecStart=/usr/bin/maglev-frontend $MAGLEV_FRONTEND_ARGS
+ExecStart=/usr/sbin/maglevd-frontend $MAGLEV_FRONTEND_ARGS
 Restart=on-failure
 RestartSec=5s
 Type=simple
 
-# Read-only presentation layer — needs no capabilities.
+# Presentation layer — needs no capabilities. /admin/ mutations go
+# through the gRPC client to maglevd, which does the privileged work.
 NoNewPrivileges=yes
 ProtectSystem=strict
 ProtectHome=yes