Add GnUserCard drawer footer; fix proxy.php cookie forwarding and /auth/ whitelist

Fix auth session persistence: add credentials:include to fetch and session_start to auth flow ...

- http.js: add credentials: 'include' to fetch() so cookies are sent
  with every API request (fixes /auth/me returning 401 after callback)
- AuthControllerTrait::resolve_user(): ensure session_start() before
  reading
- AuthController::callback(): ensure session_start() before writing

- AuthService::handleCallback(): defer DB token persistence until
  local user ID is resolved; store temp token data in session
- UserResolver: fix lastInsertId() method name, remove avatarUrl()
  call (use profile array instead)

This fixes the loop where user was redirected back to /login after
successful OAuth callback because PHP session cookie was not sent
with the /auth/me request.

Improve LoginPage design: centered card with brand, hint and clear auth button ...

- Replace GnEmptyState with custom centered login card
- Add brand icon, title and subtitle
- Make 'Sign in with gnexus-auth' button large and full-width
- Show session-check spinner while authStore.init() runs
- Rebuild production dist/

Add missing text_msgs aliases and dev proxy for auth endpoints ...

- text-msgs.php: add unauthenticated, permission_denied, invalid_callback,
  auth_failed, session_expired error messages
- vite.config.js: add /auth proxy to PHP backend for dev server

Phase 4.5: Conditional UI rendering by permissions ...

Add usePermission() guards across Vue client pages and components:

- DeviceTable: Reboot button only when devices.control
- ActionScriptsGrid: Run button only when scripts.run
- ScriptTable: Enable/Disable only when scripts.edit
- AreaTreePage: Create area only when areas.manage
- AreaDetailPage: Rename/Assign/Unassign/Remove only when areas.manage
- DeviceDetailPage: Edit/Assign/Reset only when devices.edit; ReSetup only when devices.setup; Reboot only when devices.control; Remove only when devices.delete; Firmware Update only when firmware.upload
- DevicesScanningPage: Add (setup) button only when devices.setup
- ScriptDetailPage: Run only when scripts.run; Assign/Unassign/Enable toggle only when scripts.edit
- ScriptsScopesPage: Enable/Disable only when scripts.edit
- FirmwaresListPage: Refresh Catalog only when firmware.upload

Fix ActionScriptsGrid.spec.js to seed auth store with scripts.run permission.

All 167 tests pass.

Phase 4: Vue client auth store, Bearer token injection, router guards, login page ...

Server:
- AuthControllerTrait now supports both session and Bearer token auth
  (resolves user from Authorization: Bearer header via shserv_sessions)

Vue client:
- Add api/auth.js module for access token management
- Inject Authorization: Bearer header in http.js
- Handle 401 in client.js: clear token + redirect to /auth/login
- New Pinia auth store (stores/auth.js): init, refreshToken, logout, hasPermission
- New usePermission composable
- Router guards: redirect unauthenticated to /login, permission-based route blocking
- New LoginPage.vue with gnexus-auth login button
- AppShell: conditional nav items by permission, user bar with logout
- main.js: initialize auth before mounting app
- MSW mocks: /auth/me, /auth/logout, /auth/refresh
- Fix AppShell.spec.js for Pinia + router setup

All 167 tests pass.

Fix web proxy timeout 30s→120s to match scan duration

Fix abandoned scan overload: flock lock + connection abort detection + client timeout

Phase 3: Vue client UI for firmware catalog and device OTA updates

Phase 1: Security Foundation (auth, SQLi, secrets, hashing, tokens, cookies)

Phase 6: Rename webclient-vue to webclient, match legacy dist structure

Phase 6: Rename webclient to webclient_legacy, switch to Vue client

Prevent assigning the last root area as a child ...

- Store: assignToArea now rejects with an error if the target area is the
  last remaining root (parent_id <= 0), preventing zero-root trees.
- UI: AreaDetailPage hides the 'Assign to area' / 'Change parent area'
  button and action-menu item when the current area is the last root,
  and shows an explanatory empty-state message instead.
- Tests: add coverage for both the rejection and the allowed case.

Fix resilient device state loading

Webclient. Areas favorites feature ...

- Added FavoritesStore (localStorage) for saving favorite areas
- New /areas/favorites screen with unstar button and empty state
- Star toggle button on areas tree screen
- Fixed sidebar hidden on areas-tree screen
- Set /areas/favorites as default areas page
- Fixed docs/device-spec.md duplicate section number
- Updated CLAUDE.md build instructions

Bugfixes. Webclient. DataProvider ...

Server:
- Models/Devices: alias_is_uniq excludes removed devices
- ErrorHandler: skip error page output if headers already sent

Webclient:
- DataProvider: getOrFetch, invalidate, invalidatePrefix, getCollection
- Areas cache: AreasApi.list caches raw.areas.list; placeInArea uses getOrFetch
- Cache invalidation after area/device mutations
- areaDetailsModal reads from DataProvider instead of DOMObject.provideData
- areas-tree: fix self-referencing and cycle-breaking in makeTree/renderingBranch
- placeInArea: fix unassign button not appearing after first place action
- index.php: safe TEXTMSGS parsing via PHP json_decode, no JS template literal injection
- webclient/config.php: version bump, server URL updated
- DOCS.md: DataProvider full API reference

Webpanel. DataProvider

Webpanel. DataProvider

Webpanel. Device. Hatch

New device. Hatch

Webclient. View device state. Small changes

Webclient. View sensor state

Added reset device

Fixed bug. Actions by area

Merge branch 'master' of https://git.gnexus.space/git/root/smart-home-server

merge

Added resetup function for devices

Moved props state -> status

Fix regular scripts enable/disable

fix device status component loading. Now we can tap on component for reload