Add medium-complexity PHPUnit tests: Area recursion, controller validation ...

- AreaRecursionTest (10 tests): recursive traversal, depth limit ≤10,
  remove() cascade, inner devices/scripts lookup, parent_area()
- AreasRESTAPIControllerValidationTest (10 tests): new_area, update_alias,
  remove_area, place_in_area, update_display_name validation
- DevicesRESTAPIControllerValidationTest (12 tests): setup_new_device,
  do_device_action, update_alias, devices_list, place_in_area validation
- ScriptsRESTAPIControllerValidationTest (10 tests): run_action_script,
  set_*_state, place_in_area validation
- Fix Controller::validate_positive_int_ids() return type: ?array → ?string
- Add DevTools to TestApp/bootstrap for Model instantiation
- Expand bootstrap.php text_msgs with controller error aliases
- Update server-audit.md coverage table: 80 tests, 202 assertions

Phase 5: Code quality and tech debt (side effects, dedup, dead code, config extraction, log security)

Phase 4: Device communication resilience (batch scanning, retry, configurable timeouts, non-blocking events, reset check)

Phase 3: API hardening (validation, JSON wrappers, path traversal, rate limiting)

Phase 2: Data integrity & error handling (ErrorHandler, transactions, silent SQL, HTTP statuses, dead stubs)

Phase 1: Security Foundation (auth, SQLi, secrets, hashing, tokens, cookies)

Add area_id and update_at to device detail API response ...

Include missing fields in GET /api/v1/devices/id/{id} so client-side area assignment state survives page reloads.

Use class basename for scope field in script view ...

Extracts only the short class name (e.g. SpotlightsScope) instead of the full FQN (ControlScripts\Scopes\SpotlightsScope) so client-side filtering works correctly.

Add scope field to script view output ...

Includes the Scope classname in the API response for action and regular scripts, enabling client-side filtering by scope.

Fix resilient device state loading

Webclient. Areas favorites feature ...

- Added FavoritesStore (localStorage) for saving favorite areas
- New /areas/favorites screen with unstar button and empty state
- Star toggle button on areas tree screen
- Fixed sidebar hidden on areas-tree screen
- Set /areas/favorites as default areas page
- Fixed docs/device-spec.md duplicate section number
- Updated CLAUDE.md build instructions

Bugfixes. Webclient. DataProvider ...

Server:
- Models/Devices: alias_is_uniq excludes removed devices
- ErrorHandler: skip error page output if headers already sent

Webclient:
- DataProvider: getOrFetch, invalidate, invalidatePrefix, getCollection
- Areas cache: AreasApi.list caches raw.areas.list; placeInArea uses getOrFetch
- Cache invalidation after area/device mutations
- areaDetailsModal reads from DataProvider instead of DOMObject.provideData
- areas-tree: fix self-referencing and cycle-breaking in makeTree/renderingBranch
- placeInArea: fix unassign button not appearing after first place action
- index.php: safe TEXTMSGS parsing via PHP json_decode, no JS template literal injection
- webclient/config.php: version bump, server URL updated
- DOCS.md: DataProvider full API reference

New Device API

Added new device api object

Added new device api object

Fixed device ping

better online status

Added reset device

Merge branch 'master' of https://git.gnexus.space/git/root/smart-home-server

merge

Fixed bug. Actions by area

Added new tool channels_schema_changer && fixed Device resetup && fixed time lag in events

Merge branch 'master' of https://git.gnexus.space/git/root/smart-home-server

merge

Added resetup function for devices

Moved props state -> status

Fix regular scripts enable/disable

merge

ControlScripts. Try fix

ControlScripts. Added Common.php