Fix: OAuth mobile flow + desktop auth + storage abstraction ...

- Desktop: initAccessToken() теперь вызывается всегда, не только в native
  (исправлен бесконечный цикл логина на десктопе)
- Server: returnTo читается из сессии ДО handleCallback(), пока state живой
  (исправлено: OAuth после авторизации не возвращал на mobile-bridge)
- Storage abstraction: единый адаптер storage.js (Preferences / localStorage)
- Navigation abstraction: единый navigation.js (redirectToOAuth, getOAuthReturnTo)
- AuthController::mobileBridge() — bridge page с intent:// deep link
- Android: custom MainActivity с Theme override, статус бар opaque
- Android: AndroidManifest intent-filter для shserv://auth/callback
- .gitignore: добавлен server/.env, удалён из tracking

Feat: мобильная авторизация через OAuth bridge page + CapacitorHttp ...

- Добавлен серверный endpoint /auth/mobile-bridge:
  - После OAuth callback берёт токен из сессии (refreshAccessToken)
  - Рендерит HTML-страницу, которая редиректит WebView обратно в приложение
  - Редирект: https://localhost/#/mobile-auth?token=TOKEN&expires_in=EXPIRES

- Добавлена Vue-страница /mobile-auth:
  - Ловит токен из URL query params
  - Сохраняет в localStorage через setAccessToken()
  - Инициализирует authStore и редиректит на dashboard

- Все auth-редиректы в мобильном приложении исправлены:
  - 401 в API → /#/login (вместо прямого OAuth на сервере)
  - Logout → /#/login
  - LoginPage/AppShell login → /auth/login?return_to=/auth/mobile-bridge

- Включён CapacitorHttp в capacitor.config.json:
  - Нативный HTTP стек обходит CORS, никаких серверных заголовков не нужно

- Обновлён server/dist/ (production bundle)

Feat: Android-приложение на базе Vue SPA (Capacitor) ...

- Установлен Capacitor: core, CLI, Android platform, Preferences plugin
- Добавлена страница первичной настройки сервера (/mobile-setup) только для мобильного приложения
- Реализовано хранение адреса сервера в нативных Preferences (Capacitor)
- Динамический baseUrl для API-клиента через server-config.js
- Исправлены все auth-редиректы: теперь используют абсолютный URL с учётом serverUrl
- Добавлены мобильные meta-теги в index.html (viewport-fit=cover, theme-color, safe-area)
- CSS: запрет pull-to-refresh, поддержка safe-area-inset, tap-highlight
- Android: adaptive icon из логотипа, тёмный splash screen, разрешён cleartext traffic
- Android: название приложения 'Smart Home', package com.gnexus.shserv
- Скрипты: cap:sync и cap:android для удобной сборки

Refactor: extract shared logger utils, fix edge cases in Pinia/HTTP logging

P2: Vue Client — console logging (HTTP, router, Pinia actions, error handler)

Phase 2 session stability: refresh queue, Bearer fallback, proactive refresh

Phase 1 auth security hotfixes: cookie-based session, bearer checks, router guard sync ...

- Remove access_token from OAuth callback URL (token leak fix)
- Add sanitizeReturnTo() to prevent open redirect on login/callback
- Add Bearer token expiration check in resolve_user_by_bearer()
- Add user status check in load_user_by_id() (block inactive/banned)
- Cache authStore.init() promise to prevent race condition
- Await auth init in router beforeEach guard
- Remove URL token parsing from main.js and LoginPage
- Remove hasTokenInUrl workaround from client.js 401 handler

Fix OAuth callback: extract access_token in main.js before auth init, prevent 401 redirect loop in client.js

Integrate Vue webclient into server: serve SPA from /, remove proxy.php, update auth redirects

Route all auth/login requests through proxy.php for cross-domain SPA ...

- Replace direct /auth/login with /proxy.php?path=/auth/login so the
  request reaches the PHP backend through proxy.php when the SPA runs
  on a different domain (panel.smarthome.arp vs 192.168.1.101).
- Pass full window.location.href as return_to so the OAuth callback
  redirects back to the panel domain, not the bare server IP.

Add Bearer token persistence for cross-domain SPA auth ...

- api/auth.js: persist access token in localStorage so it survives
  page reloads and works across domains (panel vs server IP).
- LoginPage.vue: on mount, check for access_token in URL query
  params (from OAuth callback) and initialize auth store.
- AuthController::callback(): append access_token + expires_in to
  the redirect URL so the SPA can capture it.

Fix auth session persistence: add credentials:include to fetch and session_start to auth flow ...

- http.js: add credentials: 'include' to fetch() so cookies are sent
  with every API request (fixes /auth/me returning 401 after callback)
- AuthControllerTrait::resolve_user(): ensure session_start() before
  reading
- AuthController::callback(): ensure session_start() before writing

- AuthService::handleCallback(): defer DB token persistence until
  local user ID is resolved; store temp token data in session
- UserResolver: fix lastInsertId() method name, remove avatarUrl()
  call (use profile array instead)

This fixes the loop where user was redirected back to /login after
successful OAuth callback because PHP session cookie was not sent
with the /auth/me request.

Phase 4: Vue client auth store, Bearer token injection, router guards, login page ...

Server:
- AuthControllerTrait now supports both session and Bearer token auth
  (resolves user from Authorization: Bearer header via shserv_sessions)

Vue client:
- Add api/auth.js module for access token management
- Inject Authorization: Bearer header in http.js
- Handle 401 in client.js: clear token + redirect to /auth/login
- New Pinia auth store (stores/auth.js): init, refreshToken, logout, hasPermission
- New usePermission composable
- Router guards: redirect unauthenticated to /login, permission-based route blocking
- New LoginPage.vue with gnexus-auth login button
- AppShell: conditional nav items by permission, user bar with logout
- main.js: initialize auth before mounting app
- MSW mocks: /auth/me, /auth/logout, /auth/refresh
- Fix AppShell.spec.js for Pinia + router setup

All 167 tests pass.

Fix abandoned scan overload: flock lock + connection abort detection + client timeout

Phase 3: Vue client UI for firmware catalog and device OTA updates

Phase 6: Rename webclient-vue to webclient, match legacy dist structure