Move scan lock file to sys temp dir to avoid prod permission issues

Debug scan locking: add shutdown cleanup + connection_aborted checks + debug log

Fix abandoned scan overload: flock lock + connection abort detection + client timeout

Phase 1: Server-side firmware catalog, OTA API endpoints, and DeviceAPI::updateFirmware

Переписан механизм определения offline: last_contact-based вместо TCP ping + retry для сканера ...

CronController::status_update_scanning():
- Устройства помечаются lost по таймауту last_contact (device_offline_threshold, default 300s)
- TCP ping fallback удалён — больше не даёт ложных active
- Сканер теперь нужен только для восстановления lost и обновления IP при роуминге
- Добавлен createDeviceScanner() для тестируемости

DeviceScanner:
- BATCH_SIZE 32 -> 8 (меньше коллизий на WiFi)
- Таймаут 1s -> 2s
- Пауза 200мс между батчами
- Retry с 500мс backoff для failed IPs

EventsController::new_event():
- Восстанавливает connection_status = active при входящем событии

DevicesRESTAPIController::device_status():
- Больше не помечает lost при временном сетевом сбое

Config:
- Добавлен device_offline_threshold (env DEVICE_OFFLINE_THRESHOLD)

Тесты: 6 новых тестов CronController, 145 tests/345 assertions — все green

Обновлять last_contact при каждом контакте с устройством

Add virtual device emulator (Flask) for relay and button types ...

- New tools/virtual_devices/ with Flask emulator, CLI, and web UI
- Supports relay (4 ch, set_state) and button (4 ch, click events)
- CLI: create, start, stop, list, status, click, remove, register
- Emulates full device REST contract: /about, /status, /action, /set_token, /reset, /channels_schema
- Web UI for visual control and monitoring
- Integrate with server registration via /api/v1/devices/setup/new-device
- Allow IP:port in setup_new_device validation for virtual devs

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Phase 7: Separate ControlScripts from server core + CLI isolation + manifest ...

- Moved server/ControlScripts/ → automation/ in repo root.
  Updated composer.json autoload classmap (../automation/).
  Common.php keeps correct sync-map.json path via __DIR__.

- Removed RequiredControlScriptsScope; 'app:online' handler moved
  directly into EventsHandlers.php as core system behaviour.

- Replaced scandir() with scopes-manifest.json in App::control_scripts_init().
  New scopes require explicit manifest entry; no auto-discovery.

- Removed /api/v1/scripts/scopes/update route and scope_update() method.
  Remote scope editing via API is no longer available.

- Added ControlScripts::run_regular_script(alias) — unified entry point
  with state check and try/catch.

- CronController::run_regular_cron_scripts() now runs each script via
  CLI process (php console.php run-regular-script <alias>).
  Added 'run-regular-script' command to console.php.

- Updated tests:
  + CronControllerTest — verifies CLI dispatch and disabled skip.
  + ControlScriptsRegularTest — tests run_regular_script():
    missing alias, disabled state, exception catch, success path.

Server: 141 tests, 339 assertions — all pass.
Client: 167 tests — all pass.

Fix Model layer & API robustness batch (7 items) ...

- Entity::update() now checks rowCount; returns false when no rows affected.
- Entity::update() preserves modified_fields on PDOException (try/catch).
- Device::set_device_token() caches auth() call instead of 3 repeated invocations.
- User::__construct() removed eager profile query; profile() now lazy-loads via get_pet_instance().
- alias_is_uniq() in Areas and Devices models accepts optional exclude_id to skip self on update.
- Controllers updated to pass entity id to alias_is_uniq() so updating alias to current value succeeds.
- CronController::run_regular_cron_scripts() wraps each script in try/catch; logs failure and continues.
- App::api_auth_guard() replaced exit() with return false; EventsHandlers stops routing on auth rejection.
- Tests added: EntityCrud (missing-record + preserved-fields), UserEntity (lazy-loading),
  CronController (failure-continuation), AppAuthGuard (structured 401 output),
  Areas/Devices validation (same-alias update allowed).
- Test bootstrap: added logs_enable/logs_folder to FCONF to suppress PHP warnings in Cron tests.

All 136 server tests pass, 334 assertions.
All 167 Vue client tests pass.

Fix critical issues: router method enforcement, cron localhost guard, rate limiter file-based, entity update_at optional, device race condition, area remove transaction, control scripts static flush

Phase 5: Code quality and tech debt (side effects, dedup, dead code, config extraction, log security)

Phase 4: Device communication resilience (batch scanning, retry, configurable timeouts, non-blocking events, reset check)

Phase 3: API hardening (validation, JSON wrappers, path traversal, rate limiting)

Add area_id and update_at to device detail API response ...

Include missing fields in GET /api/v1/devices/id/{id} so client-side area assignment state survives page reloads.

Fix resilient device state loading

better online status

Added reset device

Merge branch 'master' of https://git.gnexus.space/git/root/smart-home-server

merge

Fixed bug. Actions by area

Added new tool channels_schema_changer && fixed Device resetup && fixed time lag in events

Added resetup function for devices

Moved props state -> status

merge

Added updating device alias

Added updating of device description

Added updating of device name

Rebuild Areas tree & fix bug with create new Area modal

View areas scripts

Added placing for Scripts (Actions)