v1.47.0

New

• API tokens: any signed-in user can create personal tokens from Account -> API tokens. Full access (bgat_ prefix) authenticates as the creating user against the normal admin API with that user's own role and site/stream permissions (nothing is elevated) works without the dashboard's CSRF header, and forwards to the primary across HA replicas like a session cookie. Read-only monitoring (bgro_ prefix, administrators only) can only read aggregate metrics for all sites and the system via a new GET /_burrowgate/api/v1/monitoring and GET /_burrowgate/api/v1/sites, with no access to configuration, secrets, captured requests, or sessions. Tokens are stored as a SHA-256 hash, audited on create/revoke, and stripped from any request forwarded to a protected origin as defense in depth. See docs/API_TOKENS.md.
• OpenAPI 3.2 document: the full admin API (every /_burrowgate/api/admin/... route) is now described live at GET /_burrowgate/api/admin/openapi.json, generated from the running instance. Fetching it requires a signed-in session or full-access token.

Changed

• Dashboard metrics for bots and sites (chart view, summary sidebar, and top-list panel, across every dashboard) now return the complete data set instead of silently capping it (previously top 12/25 bots or top 5 sites). Zero-traffic entries are filtered from the list client-side instead, very long site charts keep a client-side "Other" bucket, and the summary sidebar / top-list panel now scroll instead of clipping when the full list is long.