Backchannel v0.5.4

Backchannel v0.5.4

This release reworks the post-call review and the session sidebar, and closes
two audits: one on token spend, one on how provider keys are kept.

Highlights

• A completed session opens on an Overview. It leads with the briefing's
  top outcome, then a row of counts - commitments, open loops, opportunities,
  risks and estimated spend - a two-column digest of those lists with owners
  and status, who spoke how much, and when in the call the insights arrived
  (a resumed call is drawn as call time, with a seam at each resume). Every
  count links to the tab that holds the rows behind it; when a briefing
  exists the counts follow it, and the live insight totals are stated
  alongside. The Insights tab is unchanged and remains the raw record.
• The twin "Action Cue" groups are gone. Every strategic signal carries
  its section badge (Signal, Risk, Next Question, Opportunity, Action Cue),
  and the Insights group headings were borrowing the most common badge, so
  both the current and the retired signals read "Action Cue". They now read
  "Strategic Signals" and "Signal History"; the badges on the cards and the
  live-call chips are unchanged.
• The session sidebar was rebuilt. Sessions come first, the tools moved to
  a compact footer, the whole list scrolls as one, and with six or more
  sessions a find box filters by session or group name. Each row shows its
  state as a small dot, the active session is marked, and a quiet menu on
  each row covers Rename, Move to a group and Delete. Collapsing to the icon
  rail is smooth and remembers the choice, and the sidebar opens expanded by
  default. Everything works by keyboard and on touch screens.
• The Briefing tab reads like a one-page brief. Numbered top outcomes,
  plain section headings with counts, the action plan beside the risks, and
  each item's reasoning behind a single "Why this matters" toggle. Empty
  sections are left out and named once at the foot of the page.
• Live-gateway token totals were far too low. Each usage report from the
  live model was treated as a running total and only the increase was kept,
  which on a talking call dropped most of what was billed. Usage is now
  recorded once per turn. Audio tokens and cached prompt tokens are priced at
  their own published rates rather than the text rate, and the Tokens tab
  shows cached and audio columns when a session has them. New sessions show
  higher, truer live totals; sessions recorded before this release keep the
  figures they had.
• Provider keys are harder to reach. The local API refuses requests from
  other websites and from hostnames it does not recognize, so a page open in
  the browser cannot read transcripts or spend provider budget through it.
  Provider error messages and logs are scrubbed of anything key-shaped, and a
  saved key is shown as its last four characters only. On Windows the desktop
  app protects its key file with the user's Windows account, so a copied data
  folder cannot be read elsewhere.

Also included

• The post-call Export menu and tab strip work by keyboard; the completion
  banners and the logo read correctly in dark mode; small teal text meets the
  contrast bar in both themes.
• The Docker stack binds the database and API ports to the local machine
  only; the frontend on port 3000 remains the only address on the network.

Upgrading

Installs on v0.5.3 update in place from inside the app. Installs on v0.5.2 or
earlier cannot see this release from inside the app; download the bundle for
your platform from the portal once, quit the old version from the tray, and
run the new one. Session data is stored per-user and carries forward.

The database gains three token-accounting columns, added automatically at
startup; no action is needed. On Windows, the desktop app wraps its existing
key file with your Windows account on first launch after upgrading; an
administrator-forced password reset (not a password change you make yourself)
means re-entering provider keys once in Admin -> Connections.

If you run the Docker stack and reach it by a DNS hostname rather than an IP
address or localhost, set BACKCHANNEL_ALLOWED_HOSTS to that name in .env
before starting the new version; without it the API answers 400 Host header is not allowed.