v0.5.0 — reliability & ops

Reliability & ops — see your phone's health over time, get told when something breaks, get backups off the device, and manage Matrix users from the panel. Every piece is opt-in (ENABLE_*, off by default) and adds no inbound surface.

Added

• Observability (ENABLE_METRICS) — a supervised metrics sampler records CPU/mem/swap/load/disk/temp/battery + the DEGRADED count once a minute into a capped JSONL ring on ext4. The admin panel gains a /metrics page (sparklines + a 24h health strip), a DEGRADED-aware /problems view + dashboard banner, a run doctor button, and a filter + line-count on the log viewer. See docs/OBSERVABILITY.md.
• Crash-loop alerts — setup.sh wires POCKET_ALERT_CMD (none / ntfy / healthchecks / Matrix). The Matrix channel ships ops/alert-matrix.sh, reading its token from a 0600 file.
• Off-device encrypted backup (ENABLE_OFFSITE_BACKUP) — push the age-encrypted archives to any S3-compatible bucket (R2 / B2 / S3 / Wasabi / MinIO) via a dependency-free SigV4 client (ops/offsite-s3.py + offsite-push.sh); no rclone/aws/boto3. Refuses plaintext, mirrors retention, wired into the backup daemon, panel, and pocket.sh. See docs/BACKUPS.md.
• Matrix user management (ENABLE_USER_ADMIN) — a panel /users page + ops/user-*.sh (list/create/reset-password/suspend/unsuspend/deactivate/invite) driven through continuwuity's admin command room (lib/matrix_admin.py). Each write op needs CSRF + password re-auth + audit; deactivation needs a typed confirm. See docs/USERS.md.

Fixed

• The admin panel launcher now exports all the ENABLE_* flags (and MCP_TRANSPORT) the panel reads — previously the cloud-bots / exobot / stickers / adminbot / email / mcp / filter health rows and the admin-bot widget never appeared even when enabled.

Operator-owed verification: the Matrix user-management and offsite-push paths talk to the live homeserver / object store and are best exercised on-device.

Full notes: CHANGELOG.md