[#990] 2.5.1

[realproject7]

Fixes #990

EPIC Alignment

• Parent: [EPIC] QuadWork v2.4.0 hardening & quality pass — audit remediation #967 — QuadWork hardening
• This PR's role: Version bump 2.5.0 → 2.5.1 shipping the [#968 regression] Reverse-proxy dashboard locked out of terminal WS — /api/session-token 403s the proxied Host #988 reverse-proxy WS-token hotfix (PR [#988] Reverse-proxy dashboard token allowlist (v2.5.1 hotfix) #989) that restores live terminal access on nginx-proxied dashboards.
• Contracts consumed/exposed: version fields only; PATCH per hotfix convention
• Fits with merged siblings: the release payload for [#968 regression] Reverse-proxy dashboard locked out of terminal WS — /api/session-token 403s the proxied Host #988

Self-Verification

• Bump: npm version patch --no-git-tag-version → v2.5.1; diff = package.json + package-lock.json only (+3/−3)
• Tests: node --test server/pack-smoke.test.js → pass 1, fail 0 (full suite gated by CI)
• Kill-list scan: clean

Deviations

none

🤖 Generated with Claude Code

[realproject7]

APPROVE at af59d36034b758ff816ad7b13397fa2a25ac7072 — @re2

Release-bump PR, scope verified exactly per #990: two files, patch bump only, nothing else.

Checked (evidence)

• Exactly 2 files changed. gh pr diff 991 --name-only → package.json, package-lock.json. No source/test/doc changes riding along.
• Version bump is 2.5.0 → 2.5.1 and in sync. package.json:3 root version → 2.5.1; package-lock.json:3 root version and package-lock.json packages."" version both → 2.5.1. All three version fields agree; no stray 2.5.0 left.
• No other diff. The only line changes are the version strings (+3/-3); dependencies, bin, description untouched.
• Base is main. baseRefName: main, mergeable: MERGEABLE.
• Ships the [#968 regression] Reverse-proxy dashboard locked out of terminal WS — /api/session-token 403s the proxied Host #988 hotfix already merged to main (PR [#988] Reverse-proxy dashboard token allowlist (v2.5.1 hotfix) #989).

CI note: gh pr checks 991 showed test pending at review time — content APPROVE stands; operator gate should confirm the run goes green before merge. No blocking issues.

[project7-interns]

Verdict: APPROVE

Epic Alignment: PASS

#990 asks for a version-only 2.5.0 → 2.5.1 patch release for the merged #988 hotfix; PR #991 changes only the package version fields and respects #967's no-regression release gate.

Checked (evidence)

• Structural gate: PR body contains filled ## EPIC Alignment and ## Self-Verification; no UI fidelity table required.
• Context: gh api repos/realproject7/quadwork/issues/990 + issues/967 → release bump only, package files in sync, CI required.
• Live diff: gh pr diff 991 at af59d36034b758ff816ad7b13397fa2a25ac7072 → only package.json and package-lock.json changed.
• Version sync: package.json:3, package-lock.json:3, and package-lock.json:9 are all 2.5.1.
• Riskiest part of this diff: accidental release-scope creep; acceptable because gh api pulls/991/files reports exactly 2 modified files, 3 additions, 3 deletions.
• Kill-list: scanned all items — clean.
• CI: gh pr checks 991 → test pass 59s.

Findings

None.

Decision

Approving PR #991 at af59d36034b758ff816ad7b13397fa2a25ac7072; it is the expected patch-version release bump and live CI is green.