Fix: 50px лого в nav-topbar-brand через CSS ...

- AppShell.vue: scoped стиль .nav-topbar-brand img { width: 50px; height: 50px; }

Feat: размер лого 50px в хедере, большое лого 120px на логине ...

- AppShell.vue: logo-size='50' для навигации
- LoginPage.vue: <img> с логотипом 120×120px вместо иконки

Feat: применить логотип в веб-клиенте ...

- AppShell.vue: brand='SHSERV', logo-src='/logo-cube-square.svg'
- server/dist/: добавлены favicon и logo-cube-square.svg

Логотип отображается в хедере навигации через GnNavigationShell.

Feat: обновить логотип и favicon — изометрический куб ...

- logo-cube-square.svg — куб в скруглённом квадрате (тёмно-синий фон)
- favicon.svg — компактная версия для favicon
- logo-32/64/128/256/512.png — PNG версии логотипа
- favicon-16/32/48/64px.png, apple-touch-icon.png — иконки для веб
- branding/README.md — обновлённая документация

Концепция:
- Куб — центральный хаб/контроллер умного дома
- Орбитальные точки — подключённые устройства (оранжевый/бирюзовый)
- Орбита — сеть, связь между устройствами
- Палитра: фиолетовый (#6366f1, #8b5cf6), оранжевый (#f97316),
  бирюзовый (#14b8a6), тёмно-синий фон (#1e1b4b)

Feat: добавить логотип и favicon для системы ...

- logo-primary.svg — основная версия с градиентом и WiFi/хабом
- logo-simple.svg — упрощённая версия для UI
- logo-monochrome.svg — монохромная версия для тёмных фонов
- favicon.svg, favicon-*.png — иконки для браузеров (16, 32, 48, 64px)
- apple-touch-icon.png — иконка для iOS (180×180)
- index.html — добавлены ссылки на favicon
- branding/README.md — документация и инструкции

Концепция: дом с WiFi сигналом и центральным хабом, символизирующим управление подключёнными устройствами.

Feat: форматирование дат устройств (relative time + tooltip) ...

- Добавлена утилита webclient/src/utils/date.js:
  - formatRelative() — относительный формат ("5 min ago", "1 hour ago")
  - formatDateTime() — точная дата для tooltip ("Jun 8, 2026 14:30")
  - formatDate() — короткая дата ("Jun 8, 2026")
- DeviceTable.vue: колонка Last Contact с относительным форматом + tooltip
- DeviceDetailPage.vue: last_contact → relative, create_at → полный формат
- AreaDetailPage.vue: исправлен watch на route.params.id для обновления при навигации
- Добавлены тесты date.spec.js (17 тестов)

Даты теперь читаются как "1 hour ago", при наведении — точное время.

Refactor: extract shared logger utils, fix edge cases in Pinia/HTTP logging

P2: Vue Client — console logging (HTTP, router, Pinia actions, error handler)

Phase 4 cleanup & polish: param migration seeds, gnexus-ui-kit LoginPage styles, single .env ...

- Replace raw string interpolation in migration with $tb->prepare() + execute()

- Remove all var(--color-*) from LoginPage.vue in favor of gnexus-ui-kit utility classes

- Unify .env: single server/.env, remove server/SHServ/.env override, update config.php

- Update auth-fix-plan.md: mark Phase 4 tasks complete

Phase 2 session stability: refresh queue, Bearer fallback, proactive refresh

Phase 1 auth security hotfixes: cookie-based session, bearer checks, router guard sync ...

- Remove access_token from OAuth callback URL (token leak fix)
- Add sanitizeReturnTo() to prevent open redirect on login/callback
- Add Bearer token expiration check in resolve_user_by_bearer()
- Add user status check in load_user_by_id() (block inactive/banned)
- Cache authStore.init() promise to prevent race condition
- Await auth init in router beforeEach guard
- Remove URL token parsing from main.js and LoginPage
- Remove hasTokenInUrl workaround from client.js 401 handler

Fix OAuth callback: extract access_token in main.js before auth init, prevent 401 redirect loop in client.js

Fix OAuth callback: remove refreshToken() from init() to prevent 401 cascade that clears access_token

Integrate Vue webclient into server: serve SPA from /, remove proxy.php, update auth redirects

Route all auth/login requests through proxy.php for cross-domain SPA ...

- Replace direct /auth/login with /proxy.php?path=/auth/login so the
  request reaches the PHP backend through proxy.php when the SPA runs
  on a different domain (panel.smarthome.arp vs 192.168.1.101).
- Pass full window.location.href as return_to so the OAuth callback
  redirects back to the panel domain, not the bare server IP.

Add Bearer token persistence for cross-domain SPA auth ...

- api/auth.js: persist access token in localStorage so it survives
  page reloads and works across domains (panel vs server IP).
- LoginPage.vue: on mount, check for access_token in URL query
  params (from OAuth callback) and initialize auth store.
- AuthController::callback(): append access_token + expires_in to
  the redirect URL so the SPA can capture it.

Set user-card-compact in drawer footer to full width

Close drawer on logout via backdrop click

Fix logout: session_start + destroy cookie + redirect to local /login instead of /auth/login

Make user card avatar/name clickable link to gnexus-auth profile

Remove border and padding from user-card-compact in drawer footer

Add GnUserCard drawer footer; fix proxy.php cookie forwarding and /auth/ whitelist

Fix auth session persistence: add credentials:include to fetch and session_start to auth flow ...

- http.js: add credentials: 'include' to fetch() so cookies are sent
  with every API request (fixes /auth/me returning 401 after callback)
- AuthControllerTrait::resolve_user(): ensure session_start() before
  reading
- AuthController::callback(): ensure session_start() before writing

- AuthService::handleCallback(): defer DB token persistence until
  local user ID is resolved; store temp token data in session
- UserResolver: fix lastInsertId() method name, remove avatarUrl()
  call (use profile array instead)

This fixes the loop where user was redirected back to /login after
successful OAuth callback because PHP session cookie was not sent
with the /auth/me request.

Improve LoginPage design: centered card with brand, hint and clear auth button ...

- Replace GnEmptyState with custom centered login card
- Add brand icon, title and subtitle
- Make 'Sign in with gnexus-auth' button large and full-width
- Show session-check spinner while authStore.init() runs
- Rebuild production dist/

Add missing text_msgs aliases and dev proxy for auth endpoints ...

- text-msgs.php: add unauthenticated, permission_denied, invalid_callback,
  auth_failed, session_expired error messages
- vite.config.js: add /auth proxy to PHP backend for dev server

Phase 4.5: Conditional UI rendering by permissions ...

Add usePermission() guards across Vue client pages and components:

- DeviceTable: Reboot button only when devices.control
- ActionScriptsGrid: Run button only when scripts.run
- ScriptTable: Enable/Disable only when scripts.edit
- AreaTreePage: Create area only when areas.manage
- AreaDetailPage: Rename/Assign/Unassign/Remove only when areas.manage
- DeviceDetailPage: Edit/Assign/Reset only when devices.edit; ReSetup only when devices.setup; Reboot only when devices.control; Remove only when devices.delete; Firmware Update only when firmware.upload
- DevicesScanningPage: Add (setup) button only when devices.setup
- ScriptDetailPage: Run only when scripts.run; Assign/Unassign/Enable toggle only when scripts.edit
- ScriptsScopesPage: Enable/Disable only when scripts.edit
- FirmwaresListPage: Refresh Catalog only when firmware.upload

Fix ActionScriptsGrid.spec.js to seed auth store with scripts.run permission.

All 167 tests pass.

Phase 4: Vue client auth store, Bearer token injection, router guards, login page ...

Server:
- AuthControllerTrait now supports both session and Bearer token auth
  (resolves user from Authorization: Bearer header via shserv_sessions)

Vue client:
- Add api/auth.js module for access token management
- Inject Authorization: Bearer header in http.js
- Handle 401 in client.js: clear token + redirect to /auth/login
- New Pinia auth store (stores/auth.js): init, refreshToken, logout, hasPermission
- New usePermission composable
- Router guards: redirect unauthenticated to /login, permission-based route blocking
- New LoginPage.vue with gnexus-auth login button
- AppShell: conditional nav items by permission, user bar with logout
- main.js: initialize auth before mounting app
- MSW mocks: /auth/me, /auth/logout, /auth/refresh
- Fix AppShell.spec.js for Pinia + router setup

All 167 tests pass.

Fix web proxy timeout 30s→120s to match scan duration

Fix abandoned scan overload: flock lock + connection abort detection + client timeout

Phase 3: Vue client UI for firmware catalog and device OTA updates