v0.1.0~beta6

Authentication, security hardening, scheduled bot push, gauge fixes

Authentication & security

• Session-based auth with bcrypt password hashing and 72-hour sliding expiry
• API key auth with knf_ prefix (SHA-256 hashed, shown once at creation)
• ~50 admin endpoints protected; public weather endpoints unchanged
• Setup wizard creates admin account (new 4th step)
• Login page with return-to-origin, logout redirects to dashboard
• Secret masking in config API responses (API keys, bot tokens)
• CORS tightened to configurable allowlist (KANFEI_CORS_ORIGINS)
• OpenAPI docs/redoc/openapi.json disabled in production
• Secure cookie flag auto-set when behind HTTPS proxy
• Server-side session revocation on logout
• Bot test endpoints read tokens from DB (never sent from frontend)
• Change password UI in Settings > System

Scheduled conditions push

• Periodic push of current weather to Telegram and Discord channels
• Configurable per bot: enable/disable + interval (15m, 30m, 1h, 2h, 4h)
• Immediate push on re-enable
• Independent of bot enable/disable and notification settings

Bug fixes

• History view: temperatures no longer in the hundreds (raw SI values now converted to display units)
• Bot timestamps: display station local time instead of UTC
• Config save: masked secrets rejected (prevents token corruption on save)
• Humidity gauge: arc geometry rewritten — was rendering as tiny sliver due to endpoints below SVG viewBox
• Humidity gauge: tick labels restored (variable shadowing fix)
• Humidity gauge: arc sweep direction corrected (clockwise through top)
• All gauges: increased tick/label contrast for readability

Tests

• 306 backend unit tests (29 new auth tests)
• E2E admin page specs need auth update (tracked in #86)