Render the autofill card in a closed Shadow DOM ...

The card used to be injected straight into the page: host-page CSS could
restyle it (or hide/mimic it), page JS could read the card's DOM — leaking
secret titles — and reach its buttons via querySelector on our class names.

Now it lives in a closed shadow root on a bare sized-to-zero host element:
- CSS does not cross the shadow boundary in either direction, so page styles
  can no longer repaint the card;
- the page cannot traverse into a closed root (host.shadowRoot is null), so
  secret titles and buttons are unreachable from the main world;
- src/content.css is no longer injected into page stylesheets — it is now a
  web-accessible resource, fetched once per page and injected as a <style>
  inside the shadow root (with a graceful no-styles fallback).
- while restyling the card, bring it onto the gnexus-ui-kit 1.0 palette
  (panel #16161e, left accent border, uppercase IBM Plex Mono titles) to
  match the rebuilt popup.

Verified end-to-end in real Chromium: isolation probe reports a bare empty
host, null shadowRoot, no card nodes or CSS rules reachable from the page,
no title leak under deliberately hostile page CSS (color:red !important over
all divs); clicking Use fills the form and removes the card.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Polish custom views on kit 1.0: timeline, audit chain, modals ...

- Audit: the GnEmptyState's v-else bound to the GnPagination's v-if, so the
  phantom "No audit events" block rendered alongside a populated table; move
  pagination outside the loading/rows/empty chain and gate it explicitly.
- Timeline: spell out the text fallback inside the per-item slot (a truthy
  dynamic slot always overrides GnTimeline's item.text), humanize created_at
  to local "YYYY-MM-DD HH:mm" in history and audit, pluralize the field
  count, and draw a connector rail between markers.
- Modals/toasts: drop the app-side a-show/a-hide keyframes — kit 1.0 owns
  both transitions itself; align create-modal spacing to the kit's 15px
  rhythm and add a hairline separator between modal sections.

Verified with Playwright screenshots (history, audit, create modal
open/close/reopen) on the live server; no page errors.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Release extension 0.1.1: kit 1.0 lib, shield logo icons ...

Rebuild both browsers' packages against gnexus-ui-kit 1.0 (make lib
from frontend/node_modules) and swap the generic dots mark for the
shield keyhole logo rasterized from frontend/public/logo.svg
(icon.svg + 16/32/48/128 PNG rsvg-convert). Popup verified in
chromium: settings drawer and secrets list render with no page errors.
Version bumped in extension manifest + Makefile; extensions/manifest.json
points at the 0.1.1 zips with fresh sha256/size (0.1.0 zips removed).

Co-Authored-By: Claude Code <noreply@anthropic.com>

Import browser extension source under extensions/extension ...

Move the gnexus-creds-extension sources (Chrome/Firefox MV3) from the
separate sibling repository into extensions/extension/ so builds live
next to the packaged releases this service distributes
 (extensions/dist/ + extensions/manifest.json, untouched).

- add a reproducible `make lib` target materializing lib/ from the
  frontend's pinned gnexus-ui-kit (gitignored, like before)
- drop the playwright-only package.json/lock; system node+zip suffice
- scoped .gitignore so it cannot shadow tracked extensions/dist zips
- README (main + extension): document the in-repo build and publish flow

Rebuilt zips differ from released ones only in the three lib files
(older kit in the release); extension code itself is byte-identical.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Adopt shield keyhole logo, serve dist public assets from SPA fallback ...

gnexus-creds now has its own mark: a shield with a keyhole, drawn in the
gnexus-ui-kit language (dark tile, line-art strokes, square keyhole
terminal in the role color). Ship it as frontend/public/logo.svg, use it
in the navigation shell instead of the external gnexus.space PNG, and
register it as the SVG favicon.

The SPA fallback in main.py returned index.html for every unknown path,
so /logo.svg rendered the HTML shell instead of the image; serve real
files that exist in frontend/dist first and fall back only afterwards.
Also drop two unused imports flagged by ruff.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Update gnexus-ui-kit to 1.0.0, drop vendored GnModal, use kit tokens ...

Upgrade the git dependency to 1.0.0 (allow-git for npm 12, recorded in
frontend/.npmrc). The vendored GnModal.vue copy is no longer needed: the
kit's overlay transitions are fixed upstream via useOverlayTransition,
and the official component is API-identical. Replace the five hardcoded
palette hexes in styles.css with kit design tokens so theme swaps stay
one import away.

Also restate the form-group hint styles for .tag-input: GnTagInput
renders its hint outside .form-group, so the scoped .form-group
.input-info styles from kit 1.0 miss it and the hint was glued to the
field with no top margin.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Refresh extension builds (split Chrome/Firefox) ...

Repackage the Chrome and Firefox builds from the extension repo and
update extensions/manifest.json checksums, sizes, and release date.

Co-Authored-By: Claude <noreply@anthropic.com>

Remove empty Install section from extension page ...

The install instructions block added no value and rendered empty;
drop it, keeping the build download cards and the API-token action.

Co-Authored-By: Claude <noreply@anthropic.com>

Pin mcp<2 to avoid fastmcp import breakage ...

mcp 2.0.0 removed mcp.server.fastmcp, breaking the import in
mcp_protocol.py at startup and causing uvicorn to crash (502 on all
pages after a clean image rebuild). Pin to >=1.27.1,<2 so the resolved
mcp 1.27.1 keeps the working FastMCP API.

Co-Authored-By: Claude <noreply@anthropic.com>

Add in-app extension download page ...

Distribute the gnexus-creds browser extension from the service itself.
Package Chrome and Firefox builds into extensions/dist/ with a manifest
describing version, checksums, and sizes; serve them via authenticated
FastAPI endpoints and surface a new Extension tab in the Vue UI with
download cards, SHA-256, and install instructions.

Co-Authored-By: Claude <noreply@anthropic.com>

Bump frontend version to 0.2.0

Style fixes: timeline hover, page-header layout, toolbar sort icon ...

- Disable timeline-card hover background/transform
- Fix page-header-compact: overflow initial, content row layout
- Move sort dropdown out of toolbar into actions row
- Replace sort button label with icon-only GnIconButton

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Refactor detail-header to GnPageHeader and remove obsolete card hover override ...

- Replace custom detail-header div with GnPageHeader component
- Remove custom .detail-header and .detail-title CSS
- Remove card:hover animation override (animations removed from UI kit)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Apply gnexus-ui-kit 0.4.0 improvements: GnCopyButton, GnTagInput, GnSwitch, GnConfirmDialog, GnTooltip, GnUserCard ...

- Replace manual copy logic with GnCopyButton in SecretDetailPanel
- Replace comma-separated tag input with GnTagInput (array-based)
- Replace access checkboxes with GnSwitch for better UX
- Replace custom confirm modals with GnConfirmDialog
- Add GnTooltip to reveal/hide/edit action icons
- Replace admin table with GnUserCard grid layout
- Replace error paragraphs with GnAlert components
- Remove copiedFieldKey and copyValue custom logic
- Update form tags handling from string to array

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Update gnexus-ui-kit to 0.4.0 ...

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Always set allow_mcp=true for secrets created through MCP tools ...

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix MCP /mcp-protocol/ 421 error: disable DNS rebinding protection and fix SPA fallback ...

- Disable MCP SDK transport_security DNS rebinding protection (nginx handles it)
- Fix SPA fallback to exclude /mcp-protocol without trailing slash
- Add transport_security import to mcp_protocol.py

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Production-ready rewrite: UI kit integration, admin backups, sorting, profile editing, and security hardening ...

- Frontend: complete rewrite using gnexus-ui-kit components (GnNavigationShell,
  GnTable, GnTimeline, GnModal, GnToastProvider, GnSkeleton, etc.)
- Frontend: browser route sync (/secrets/:id, /audit/:id), pagination,
  real-time search debounce, skeleton loading states, retry with backoff
- Frontend: profile editing modal, token creation with scope selection,
  import/export, settings metrics, admin users table
- Backend: backup/restore endpoints for PostgreSQL and SQLite via pg_dump/psql
- Backend: admin backup CRUD, file download endpoint
- Backend: stats endpoint, PATCH /me profile endpoint, CORS middleware,
  graceful shutdown logging
- Backend: table sorting (sort_by/sort_dir) in list_secrets
- Backend: OAuth return_to validation, rate limiting on sensitive endpoints
- MCP: validation fixes, tool description improvements, protocol cleanup
- Tests: 44 passing including new backup test suite
- Docker: add postgresql-client, backups volume, deployment docs
- Docs: backup/restore instructions in deployment guide

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add deployment and MCP connection guide

Improve MCP tool instructions

Hide unused tab panels

Compact header search

Remove workspace surface framing

Move search into page header

Add routes for secret detail pages

Sync tabs with browser routes

Split secrets list and detail views

Use table for secrets list

Show toast after copying values

Use dropdown for secret actions