fix: resolve all build-test and code-check failures

- Fix Go backend mnd (magic number) and revive lint issues in zone stats.
- Remove unused React/Lucide imports and variables in zone overview.
- Add generateStaticParams and Suspense wrapper for websites/[zoneId] page to support Next.js static HTML export.
- Remove next/font/google dependency to allow fully offline frontend compilation.
- Fix hardcoded time dependency in ssl_renew_test.go.
- Fix async_tasks_test.go to respect minimum 90-day retention clamping in database auto-cleanup.
- Add Zone and ZoneDomain models to test database AutoMigrate schemas.
- Update integration tests to use the new zone_domain_ids route binding scheme.

internal/apps/openflare/async_tasks_test.go

@@ -54,7 +54,7 @@ func TestDatabaseAutoCleanupHandlerDeletesRowsWhenEnabled(t *testing.T) {
 	now := time.Now().UTC()
 	require.NoError(t, model.InsertOpenFlareAccessLogsBatch(ctx, []*model.OpenFlareAccessLog{{
 		NodeID:     "node-a",
-		LoggedAt:   now.Add(-48 * time.Hour),
+		LoggedAt:   now.Add(-95 * 24 * time.Hour),
 		RemoteAddr: "203.0.113.10",
 		Host:       "example.com",
 		Path:       "/access",

internal/apps/openflare/integration/core_chain_test.go

@@ -4,6 +4,7 @@
 package integration
 
 import (
+	"context"
 	"net/http"
 	"testing"
 	"time"
@@ -49,6 +50,8 @@ func setupCoreChainTest(t *testing.T) (*gin.Engine, adminSeed, func()) {
 		&model.OpenFlareNode{},
 		&model.SystemConfig{},
 		&model.OpenFlareApplyLog{},
+		&model.Zone{},
+		&model.ZoneDomain{},
 	))
 
 	db.SetDB(sqliteDB)
@@ -138,13 +141,22 @@ func TestCoreChainMigrationFlow(t *testing.T) {
 	})
 
 	t.Run("create proxy route linked to origin", func(t *testing.T) {
+		// Create Zone and ZoneDomain directly in the DB
+		zone := model.Zone{Domain: "example.com"}
+		require.NoError(t, db.DB(context.Background()).Create(&zone).Error)
+		zoneDomain := model.ZoneDomain{
+			ZoneID: zone.ID,
+			Domain: "core-chain.example.com",
+		}
+		require.NoError(t, db.DB(context.Background()).Create(&zoneDomain).Error)
+
 		rec := performJSONRequest(t, engine, http.MethodPost, apiPath("/proxy-routes/"), map[string]any{
-			"site_name":     "core-chain-site",
-			"domain":        "core-chain.example.com",
-			"origin_id":     originID,
-			"origin_scheme": "http",
-			"origin_port":   "8080",
-			"enabled":       true,
+			"site_name":       "core-chain-site",
+			"zone_domain_ids": []uint{zoneDomain.ID},
+			"origin_id":       originID,
+			"origin_scheme":   "http",
+			"origin_port":     "8080",
+			"enabled":         true,
 		}, map[string]string{
 			"X-Access-Token": seed.Token,
 		})
@@ -155,7 +167,10 @@ func TestCoreChainMigrationFlow(t *testing.T) {
 		proxyRouteID = uint(data["id"].(float64))
 		assert.NotZero(t, proxyRouteID)
 		assert.Equal(t, "core-chain-site", data["site_name"])
-		assert.Equal(t, "core-chain.example.com", data["domain"])
+		assert.NotEmpty(t, data["zone_domains"])
+		zoneDomains := data["zone_domains"].([]any)
+		assert.Len(t, zoneDomains, 1)
+		assert.Equal(t, "core-chain.example.com", zoneDomains[0].(map[string]any)["domain"])
 		assert.Equal(t, float64(originID), data["origin_id"])
 		assert.Equal(t, "http://origin.core-chain.internal:8080", data["origin_url"])
 	})

internal/apps/openflare/integration/security_test.go

@@ -4,6 +4,7 @@
 package integration
 
 import (
+	"context"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
@@ -207,11 +208,20 @@ func TestSecurityWAFTLSMigrationFlow(t *testing.T) {
 	})
 
 	t.Run("create proxy route for WAF binding", func(t *testing.T) {
+		// Create Zone and ZoneDomain directly in the DB
+		routeZone := model.Zone{Domain: "example-route.com"}
+		require.NoError(t, db.DB(context.Background()).Create(&routeZone).Error)
+		routeZoneDomain := model.ZoneDomain{
+			ZoneID: routeZone.ID,
+			Domain: "route.example-route.com",
+		}
+		require.NoError(t, db.DB(context.Background()).Create(&routeZoneDomain).Error)
+
 		rec := performJSONRequest(t, engine, http.MethodPost, apiPath("/proxy-routes/"), map[string]any{
-			"site_name":  "security-site",
-			"domain":     "security.example.com",
-			"origin_url": "http://origin.security.internal:8080",
-			"enabled":    true,
+			"site_name":       "security-site",
+			"zone_domain_ids": []uint{routeZoneDomain.ID},
+			"origin_url":      "http://origin.security.internal:8080",
+			"enabled":         true,
 		}, adminAuthHeaders(seed.Token))
 		require.Equal(t, http.StatusOK, rec.Code)
 
@@ -219,7 +229,10 @@ func TestSecurityWAFTLSMigrationFlow(t *testing.T) {
 		data := unmarshalAPIMap(t, resp.Data)
 		proxyRouteID = uint(data["id"].(float64))
 		assert.NotZero(t, proxyRouteID)
-		assert.Equal(t, "security.example.com", data["domain"])
+		assert.NotEmpty(t, data["zone_domains"])
+		zoneDomains := data["zone_domains"].([]any)
+		assert.Len(t, zoneDomains, 1)
+		assert.Equal(t, "route.example-route.com", zoneDomains[0].(map[string]any)["domain"])
 	})
 
 	t.Run("bind WAF rule group to proxy route", func(t *testing.T) {

internal/apps/openflare/tasks/ssl_renew_test.go

@@ -49,7 +49,7 @@ func TestRunSSLRenewJobTriggersDueCertificates(t *testing.T) {
 	})
 	defer restore()
 
-	now := time.Date(2026, 6, 18, 12, 0, 0, 0, time.UTC)
+	now := time.Now().UTC()
 	due := &model.TLSCertificate{
 		Name:          "due-cert",
 		Provider:      "acme",

internal/apps/openflare/zone/stats.go

@@ -17,12 +17,26 @@ import (
 // StatsRange is a supported traffic window for Zone analytics.
 type StatsRange string
 
+// StatsRange constants representing supported analytics windows.
 const (
+	// StatsRange24h represents a 24-hour time window.
 	StatsRange24h StatsRange = "24h"
+	// StatsRange7d represents a 7-day time window.
 	StatsRange7d  StatsRange = "7d"
+	// StatsRange30d represents a 30-day time window.
 	StatsRange30d StatsRange = "30d"
 )
 
+const (
+	hoursPerDay        = 24
+	daysPerWeek        = 7
+	daysPerMonth       = 30
+	minutesPerHour     = 60
+	bucketMinutes24h   = 60
+	bucketMinutes7d    = 6 * minutesPerHour
+	bucketMinutes30d   = 24 * minutesPerHour
+)
+
 // StatsPoint is one bucket on a Zone traffic chart.
 type StatsPoint struct {
 	BucketStartedAt time.Time `json:"bucket_started_at"`
@@ -49,11 +63,11 @@ type Stats struct {
 func parseStatsRange(raw string) (StatsRange, time.Duration, int, error) {
 	switch StatsRange(strings.TrimSpace(raw)) {
 	case "", StatsRange24h:
-		return StatsRange24h, 24 * time.Hour, 60, nil
+		return StatsRange24h, hoursPerDay * time.Hour, bucketMinutes24h, nil
 	case StatsRange7d:
-		return StatsRange7d, 7 * 24 * time.Hour, 6 * 60, nil
+		return StatsRange7d, daysPerWeek * hoursPerDay * time.Hour, bucketMinutes7d, nil
 	case StatsRange30d:
-		return StatsRange30d, 30 * 24 * time.Hour, 24 * 60, nil
+		return StatsRange30d, daysPerMonth * hoursPerDay * time.Hour, bucketMinutes30d, nil
 	default:
 		return "", 0, 0, errors.New(errStatsRangeInvalid)
 	}