Add PHPUnit coverage: Entity CRUD, Area placing, Sessions, Utils ...

- EntityCrudTest: 6 tests covering update, get, remove, id, to_array
- AreaPlacingTest: 2 tests for place_in_area and place_in_area_id
- SessionsTest: 4 tests for create, get_by_token, close, status
- UtilsTest: 7 tests for response_error/success, table_row_is_exists,
  generate_token, dayname_translate, fast_ping_tcp
- TestApp helper + bootstrap init with SQLite :memory: for app() dependencies
- Update server-audit.md: 36 total tests, expand coverage roadmap

Add PHPUnit test suite: ThinBuilder, RateLimiter, PasswordHash (17 tests, all passing)

Phase 5: Code quality and tech debt (side effects, dedup, dead code, config extraction, log security)

Phase 4: Device communication resilience (batch scanning, retry, configurable timeouts, non-blocking events, reset check)

Phase 3: API hardening (validation, JSON wrappers, path traversal, rate limiting)

Phase 2: Data integrity & error handling (ErrorHandler, transactions, silent SQL, HTTP statuses, dead stubs)

Phase 1: Security Foundation (auth, SQLi, secrets, hashing, tokens, cookies)

Add area_id and update_at to device detail API response ...

Include missing fields in GET /api/v1/devices/id/{id} so client-side area assignment state survives page reloads.

Use class basename for scope field in script view ...

Extracts only the short class name (e.g. SpotlightsScope) instead of the full FQN (ControlScripts\Scopes\SpotlightsScope) so client-side filtering works correctly.

Add scope field to script view output ...

Includes the Scope classname in the API response for action and regular scripts, enabling client-side filtering by scope.

Fix resilient device state loading

Webclient. Areas favorites feature ...

- Added FavoritesStore (localStorage) for saving favorite areas
- New /areas/favorites screen with unstar button and empty state
- Star toggle button on areas tree screen
- Fixed sidebar hidden on areas-tree screen
- Set /areas/favorites as default areas page
- Fixed docs/device-spec.md duplicate section number
- Updated CLAUDE.md build instructions

Merge branch 'master' of https://git.gnexus.space/git/root/smart-home-server

Bugfixes. Webclient. DataProvider ...

Server:
- Models/Devices: alias_is_uniq excludes removed devices
- ErrorHandler: skip error page output if headers already sent

Webclient:
- DataProvider: getOrFetch, invalidate, invalidatePrefix, getCollection
- Areas cache: AreasApi.list caches raw.areas.list; placeInArea uses getOrFetch
- Cache invalidation after area/device mutations
- areaDetailsModal reads from DataProvider instead of DOMObject.provideData
- areas-tree: fix self-referencing and cycle-breaking in makeTree/renderingBranch
- placeInArea: fix unassign button not appearing after first place action
- index.php: safe TEXTMSGS parsing via PHP json_decode, no JS template literal injection
- webclient/config.php: version bump, server URL updated
- DOCS.md: DataProvider full API reference

Control scxripts

New Device API

Added new device api object

Added new device api object

Fixed device ping

better online status

Added reset device

Merge branch 'master' of https://git.gnexus.space/git/root/smart-home-server

merge

merge

Fixed bug. Actions by area

Added new tool channels_schema_changer && fixed Device resetup && fixed time lag in events

Merge branch 'master' of https://git.gnexus.space/git/root/smart-home-server

merge

Added resetup function for devices

ControlScripts. Small changes