v2.13.0

v2.13.0

Security

• PUT /api/mesh/self is admin-gated. It writes this site's WireGuard identity, exit posture and LAN/DNS mapping — previously any authenticated user could clobber the gateway public key (breaking every tunnel to this site cluster-wide), flip exitOpen, or remap DNS/LAN. The legitimate gateway authenticates with a PAT minted as the directory admin, so requireAdmin lets it through while keeping everyone else out.
• GET /api/mesh/peers and /api/mesh/site-clients are admin-gated. Both expose the full network map and device registry, and exist for the gateway to consume.
• GET /api/mesh/roster scrubs WireGuard keys/endpoints for non-admins. The mesh page still shows site metadata, but no longer hands a regular user full network enumeration (gatewayPublished boolean instead of the key).

Fixed

• The Multi-Site modal's gateway-mesh count no longer 404s. It called GET /api/mesh/gateways, an endpoint that died with the mesh-v2 rewrite. The count is now computed locally from the MeshSite roster (the directory IS the registry in v2).
• The LDIF import confirm is no longer a native confirm() — it uses the app's promise-based app.messages.confirm(...) modal.

Other

• Synced the served theta-agent/install.sh with theta-agent v2.5.0 (join-key merge + Linux tray arch).