Phase 2: Protect Areas, Scripts, Firmware REST API endpoints with permission checks ...

- AreasRESTAPIController: areas.view / areas.manage / devices.control / devices.view / scripts.view
- ScriptsRESTAPIController: scripts.view / scripts.edit / scripts.run
- FirmwareRESTAPIController: firmware.view / firmware.upload
- AuthControllerTrait added to all three controllers

Phase 2: Protect DevicesRESTAPIController endpoints with permission checks ...

- Add AuthControllerTrait
- devices.scan: scanning__ready_to_setup, scanning__all
- devices.setup: setup_new_device, resetup_device
- devices.delete: remove_device
- devices.control: reboot_device, do_device_action
- devices.view: device_info, device, device_status, devices_list
- devices.edit: place_in_area, unassign_from_area, update_name, update_description, update_alias, reset_device

Update docs: guest is explicit authenticated role, no anonymous access

Add .env with real gnexus-auth Client credentials for dev

Phase 0: gnexus-auth integration infrastructure ...

- Add gnexus/auth-client via Composer vcs
- Thin PSR-18/17 cURL adapter (zero extra deps)
- SessionStateStore, SessionPkceStore, DbTokenStore
- AuthService wrapper: login URL, callback, logout, refresh, me
- UserResolver + PermissionResolver
- AuthController (login, callback, logout, me, refresh)
- WebhookController + WebhookRouter + event handlers
- AuthControllerTrait for endpoint protection
- Migration: 9 tables (users, roles, permissions, overrides, groups, members, group_perms, sessions, audit) + seed data
- Remove old Example_AuthController
- Add GAUTH_* env variables to config and .env.example

Fix text_msg call in remove_device: use FCONF instead of undefined app()-method

Fix ErrorHandler to catch Throwable (not just Exception) and safe null-check in remove_device

Move scan debug log to sys temp dir as well

Move scan lock file to sys temp dir to avoid prod permission issues

Allow deleting offline devices: make /reset best-effort, always remove from DB

Fix web proxy timeout 30s→120s to match scan duration

Increase scan batch size 8→32 to cut usleep overhead (~54s→37s)

Fix scan speed: use CURLOPT_*_MS for sub-second timeouts (was ~3s per IP on Linux)

Debug scan locking: add shutdown cleanup + connection_aborted checks + debug log

Fix abandoned scan overload: flock lock + connection abort detection + client timeout

Revert ControlScripts back to repo-root automation/ (Phase 7 structure)

Замена тестовых ControlScripts на продакшн версию из smart-home-server

Откат пользовательской авторизации и миграционной системы ...

- Убран auth guard из EventsHandlers (API снова открыт)
- Удалены check_api_auth / api_auth_guard из App.php
- Удален Sessions.php и инстанцирование сессий
- Удалена миграционная система (Migration.php, MigrationsManager.php)
- Удалены файлы миграций create_sessions_table и fix_sessions_status
- Откачен console.php до прежнего состояния (убраны CLI migrate-команды)
- Удален тест AppAuthGuardTest.php
- Таблицы sessions и migrations дропнуты из БД

Пользовательский логин запланирован на потом; до тех пор API работает без Bearer/cookie auth.

Add migrations system for database schema management ...

- Create SHServ\Migrations\Migration base class with up()/down()
- Create MigrationsManager: tracks applied migrations in  table,
  supports migrate, rollback, status, and create commands
- Integrate with console.php: migrate, migrate:rollback, migrate:status,
  migrate:create
- Add first migration: create_sessions_table (needed for Session Entity)
- Use correct ThinBuilder field format for defaults and nullability

Fix framework bugs found during OTA testing ...

- DevTools: guard against empty sql_queries array before accessing last index
- RouterImplementation: skip empty route var names in POST routing
- CallControl: skip empty route var names when building action params
- Update .gitignore to exclude Cache, Logs, and firmwares dirs

Phase 4: build.sh manifest generation, ZIP packaging, docs update

Phase 3: Vue client UI for firmware catalog and device OTA updates

Phase 2: Add platform, channels, core_version to virtual emulator and OTA endpoint

Phase 1: Server-side firmware catalog, OTA API endpoints, and DeviceAPI::updateFirmware

Phase 0: Add platform to device /about and normalize firmware versions

Переписан механизм определения offline: last_contact-based вместо TCP ping + retry для сканера ...

CronController::status_update_scanning():
- Устройства помечаются lost по таймауту last_contact (device_offline_threshold, default 300s)
- TCP ping fallback удалён — больше не даёт ложных active
- Сканер теперь нужен только для восстановления lost и обновления IP при роуминге
- Добавлен createDeviceScanner() для тестируемости

DeviceScanner:
- BATCH_SIZE 32 -> 8 (меньше коллизий на WiFi)
- Таймаут 1s -> 2s
- Пауза 200мс между батчами
- Retry с 500мс backoff для failed IPs

EventsController::new_event():
- Восстанавливает connection_status = active при входящем событии

DevicesRESTAPIController::device_status():
- Больше не помечает lost при временном сетевом сбое

Config:
- Добавлен device_offline_threshold (env DEVICE_OFFLINE_THRESHOLD)

Тесты: 6 новых тестов CronController, 145 tests/345 assertions — все green

Обновлять last_contact при каждом контакте с устройством

Add comprehensive documentation for virtual device emulator ...

- tools/virtual_devices/README.md: full user guide with CLI, curl, Web UI
- docs/virtual-device-emulator.md: architecture docs with end-to-end example
- docs/architecture.md: mention virtual emulator in device section
- CLAUDE.md: add virtual-device-emulator.md to key files table

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Add virtual device emulator (Flask) for relay and button types ...

- New tools/virtual_devices/ with Flask emulator, CLI, and web UI
- Supports relay (4 ch, set_state) and button (4 ch, click events)
- CLI: create, start, stop, list, status, click, remove, register
- Emulates full device REST contract: /about, /status, /action, /set_token, /reset, /channels_schema
- Web UI for visual control and monitoring
- Integrate with server registration via /api/v1/devices/setup/new-device
- Allow IP:port in setup_new_device validation for virtual devs

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Phase 7: Separate ControlScripts from server core + CLI isolation + manifest ...

- Moved server/ControlScripts/ → automation/ in repo root.
  Updated composer.json autoload classmap (../automation/).
  Common.php keeps correct sync-map.json path via __DIR__.

- Removed RequiredControlScriptsScope; 'app:online' handler moved
  directly into EventsHandlers.php as core system behaviour.

- Replaced scandir() with scopes-manifest.json in App::control_scripts_init().
  New scopes require explicit manifest entry; no auto-discovery.

- Removed /api/v1/scripts/scopes/update route and scope_update() method.
  Remote scope editing via API is no longer available.

- Added ControlScripts::run_regular_script(alias) — unified entry point
  with state check and try/catch.

- CronController::run_regular_cron_scripts() now runs each script via
  CLI process (php console.php run-regular-script <alias>).
  Added 'run-regular-script' command to console.php.

- Updated tests:
  + CronControllerTest — verifies CLI dispatch and disabled skip.
  + ControlScriptsRegularTest — tests run_regular_script():
    missing alias, disabled state, exception catch, success path.

Server: 141 tests, 339 assertions — all pass.
Client: 167 tests — all pass.