Phase 5: Code quality and tech debt (side effects, dedup, dead code, config extraction, log security)

Update server-audit.md: mark Phase 4 complete (commit b4968d4)

Phase 4: Device communication resilience (batch scanning, retry, configurable timeouts, non-blocking events, reset check)

Phase 3: API hardening (validation, JSON wrappers, path traversal, rate limiting)

Phase 2: Data integrity & error handling (ErrorHandler, transactions, silent SQL, HTTP statuses, dead stubs)

Phase 1: Security Foundation (auth, SQLi, secrets, hashing, tokens, cookies)

Phase 6: Rename webclient-vue to webclient, match legacy dist structure

Phase 6: Rename webclient to webclient_legacy, switch to Vue client

Refresh area device states after running an action script

Show only regular scripts in AreaDetailPage scripts panel

Reorder AreaDetailPage sections: actions first, then devices, parent area, scripts

Extract ActionScriptsGrid reusable component

Add area action scripts grid to AreaDetailPage

Persist area tree expansion state to localStorage across page reloads

Persist area tree node expansion state across data reloads

Render connection status as Online/Offline in device list and detail pages

Fix device_type mapping in unifyDeviceFields and hide active system status badge in list

Show system status badge on devices list and detail pages

Add device reset and resetup to Vue client

Fix bugs, migrate favorites store to Composition API, DRY state loader, add page tests, replace CSS vars with kit classes

Move unassign into a dedicated confirm dialog and fix icon ...

- Revert useAreaAssign composable back to pure assign logic; remove
  submitUnassignCore and unassign state that leaked into the assign modal.
- DeviceDetailPage, ScriptDetailPage, AreaDetailPage:
  * Remove the Unassign button from the assign modal footer.
  * Add a separate GnModal confirm dialog for unassign (like Remove).
  * Dropdown action now opens the confirm dialog instead of firing
    immediately.
  * Replace non-existent ph-map-pin-slash icon with ph-x-circle.

Show warning in assign modal for the last root area ...

Instead of hiding the assign UI, keep the button/menu item visible.
When the user opens the assign modal for the last root area, show a
GnAlert warning inside the modal explaining that it cannot be assigned.
The Assign button is hidden in this state; only Cancel (and Unassign if
applicable) remain. Backend guard in assignToArea stays as a fail-safe.

Add unassign action to area, device and script detail pages ...

- useAreaAssign composable: add submitUnassignCore and loading/error states.
- DeviceDetailPage: add 'Unassign from area' button inside assign modal and
  in the actions dropdown when device has an area_id.
- ScriptDetailPage: same for scripts (non-scope) with area_id.
- AreaDetailPage: add 'Unassign from parent' in assign modal and dropdown
  when area has a parent_id > 0.

Prevent assigning the last root area as a child ...

- Store: assignToArea now rejects with an error if the target area is the
  last remaining root (parent_id <= 0), preventing zero-root trees.
- UI: AreaDetailPage hides the 'Assign to area' / 'Change parent area'
  button and action-menu item when the current area is the last root,
  and shows an explanatory empty-state message instead.
- Tests: add coverage for both the rejection and the allowed case.

Use gnexus-ui-kit semantic colors for device status dot and add state components ...

- Status dot in DeviceTable now uses .text-success / .text-danger from
  gnexus-ui-kit with currentColor for background and glow instead of
  project-specific CSS vars.
- Add DeviceChannelsState component for per-channel state rendering.
- Add loadStatesFor helper in devices store for targeted state loading.
- Record styling rule in CLAUDE.md: always prefer kit color classes.

Replace connect column with inline status dot in device table

Make toast backgrounds opaque for readability

Show per-channel device states in DeviceTable and load states on AreaDetailPage

Add toast feedback for device reboot in list and detail views

Fix area assignment button on detail pages ...

- Rename submitAssign -> submitAssignCore in useAreaAssign composable
  to avoid name collision with local page handlers.
- Rename local page handlers -> handleAssignSubmit on Area, Device,
  and Script detail pages so event bindings call the wrapper correctly.
- Fix AppEmptyState.vue to forward #action slot into GnEmptyState's
  #actions slot so the Assign button renders for unassigned items.