chore: clean git cache

CHANGELOG.md

@@ -1,466 +0,0 @@
-# Changelog
-
-All notable changes to Charon will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-### CI/CD
-- **Supply Chain**: Optimized verification workflow to prevent redundant builds
-  - Change: Removed direct Push/PR triggers; now waits for 'Docker Build' via `workflow_run`
-
-### Security
-- **Supply Chain**: Enhanced PR verification workflow stability and accuracy
-  - **Vulnerability Reporting**: Eliminated false negatives ("0 vulnerabilities") by enforcing strict failure conditions
-  - **Tooling**: Switched to manual Grype installation ensuring usage of latest stable binary
-  - **Observability**: Improved debugging visibility for vulnerability scans and SARIF generation
-
-### Performance
-- **E2E Tests**: Reduced feature flag API calls by 90% through conditional polling optimization (Phase 2)
-  - Conditional skip: Exits immediately if flags already in expected state (~50% of cases)
-  - Request coalescing: Shares in-flight API requests between parallel test workers
-  - Removed unnecessary `beforeEach` polling, moved cleanup to `afterEach` for better isolation
-  - Test execution time improved by 31% (23 minutes → 16 minutes for system settings tests)
-- **E2E Tests**: Added cross-browser label helper for consistent locator behavior across Chromium, Firefox, WebKit
-  - New `getFormFieldByLabel()` helper with 4-tier fallback strategy
-  - Resolves browser-specific differences in label association and form field location
-  - Prevents timeout errors in Firefox/WebKit caused by strict label matching
-
-### Fixed
-- Fixed: Added robust validation and debug logging for Docker image tags to prevent invalid reference errors.
-- Fixed: Removed log masking for image references and added manifest validation to debug CI failures.
-- **CI**: Fixed Docker image reference output so integration jobs never pull an empty image ref
-- **E2E Test Reliability**: Resolved test timeout issues affecting CI/CD pipeline stability
-  - Fixed config reload overlay blocking test interactions
-  - Improved feature flag propagation with extended timeouts
-  - Added request coalescing to reduce API load during parallel test execution
-  - Test pass rate improved from 96% to 100% for core functionality
-- **Test Performance**: Reduced system settings test execution time by 31% (from 23 minutes to 16 minutes)
-
-### Changed
-- **Testing Infrastructure**: Enhanced E2E test helpers with better synchronization and error handling
-- **CI**: Optimized E2E workflow shards [Reduced from 4 to 3]
-
-### Fixed
-
-- **E2E Tests**: Fixed timeout failures in WebKit/Firefox caused by switch component interaction
-  - **Switch Interaction**: Replaced direct hidden input clicks with semantic label clicks in `tests/utils/ui-helpers.ts`
-  - **Wait Strategy**: Added explicit `await expect(toggle).toBeChecked()` verification replaced fixed `waitForTimeout`
-  - **Cross-Browser**: Resolved `element not visible` and `click intercepted` errors in Firefox/WebKit
-  - **Reference**: See `docs/implementation/2026-02-02_backend_coverage_security_fix.md`
-- **Security**: Fixed 3 critical vulnerabilities in path sanitization (safeJoin)
-  - **Vulnerability**: Path traversal risk in `backend/internal/caddy/config_loader.go`, `config_manager.go`, and `import_handler.go`
-  - **Remediation**: Replaced `filepath.Join` with `utils.SafeJoin` to prevent directory traversal attacks
-  - **Validation**: Added comprehensive test cases for path traversal attempts
-- **Backend Tests**: Improved backend test coverage using real-dependency pattern
-  - **Architecture**: Switched from interface mocking to concrete types for `ConfigLoader` and `ConfigManager` testing
-  - **Coverage**: Increased coverage for critical configuration management components
-- **E2E Tests**: Fixed timeout failures in feature flag toggle tests caused by backend N+1 query pattern
-  - **Backend Optimization**: Replaced N+1 query pattern with single batch query in `/api/v1/feature-flags` endpoint
-  - **Performance Improvement**: 3-6x latency reduction (600ms → 200ms P99 in CI environment)
-  - **Test Refactoring**: Replaced hard-coded waits with condition-based polling using `waitForFeatureFlagPropagation()`
-  - **Retry Logic**: Added exponential backoff retry wrapper for transient failures (3 attempts: 2s, 4s, 8s delays)
-  - **Comprehensive Edge Cases**: Added tests for concurrent toggles, network failures, and rollback scenarios
-  - **CI Pass Rate**: Improved from ~70% to 100% with zero timeout errors
-  - **Affected Tests**: `tests/settings/system-settings.spec.ts` (Cerberus, CrowdSec, Uptime, Persist toggles)
-  - See [Feature Flags Performance Documentation](docs/performance/feature-flags-endpoint.md)
-- **E2E Tests**: Fixed feature toggle timeout failures and clipboard access errors
-  - **Feature Toggles**: Replaced race-prone `Promise.all()` with sequential wait pattern (PUT 15s, GET 10s timeouts)
-  - **Clipboard**: Added browser-specific verification (Chromium reads clipboard, Firefox/WebKit verify toast)
-  - **Affected Tests**: Settings → System Settings (Cerberus, CrowdSec, Uptime, Persist toggles), User Management (invite link copy)
-  - **CI Impact**: All browsers now pass without timeouts or NotAllowedError
-- **E2E Tests**: Fixed timing issues in DNS provider type selection tests (Manual, Webhook, RFC2136, Script)
-  - Root cause: Field wait strategy incompatible with React re-render timing and conditional rendering
-  - Solution: Simplified field wait strategy to use direct visibility check with 5-second timeout
-  - Results: All DNS provider tests verified passing (544/602 E2E tests passing, 90% pass rate)
-- **E2E Tests**: Fixed race condition in DNS provider type tests (RFC2136, Webhook) by replacing fixed timeouts with semantic element waiting
-- **Frontend**: Removed dead code (`useProviderFields` hook) that attempted to call non-existent API endpoint
-- **E2E Test Remediation**: Fixed multi-file Caddyfile import API contract mismatch (PR #XXX)
-  - Frontend `uploadCaddyfilesMulti` now sends `{filename, content}[]` to match backend contract
-  - `ImportSitesModal.tsx` updated to pass filename with file content
-  - Added `CaddyFile` interface to `frontend/src/api/import.ts`
-- **Caddy Import**: Fixed file server warning not displaying on import attempts
-  - `ImportCaddy.tsx` now extracts warning messages from 400 response body
-  - Warning banner displays when attempting to import Caddyfiles with unsupported directives (e.g., `file_server`)
-- **E2E Tests**: Fixed settings PUT/POST method mismatch in E2E tests
-  - Updated `system-settings.spec.ts` restore fixture to use POST instead of PUT
-- **E2E Tests**: Added `data-testid="config-reload-overlay"` to `ConfigReloadOverlay` component
-  - Enables reliable selector for testing feature toggle overlay visibility
-- **E2E Tests**: Skipped WAF enforcement test (middleware behavior tested in integration)
-  - `waf-enforcement.spec.ts` now skipped with reason referencing `backend/integration/coraza_integration_test.go`
-- **CI**: Added missing Chromium dependency for Security jobs
-- **E2E Tests**: Stabilized Proxy Host and Certificate tests (wait helpers, locators)
-
-### Changed
-
-- **Codecov Configuration**: Added 77 comprehensive ignore patterns to align CI coverage with local calculations
-  - Excludes test files (`*.test.ts`, `*.test.tsx`, `*_test.go`)
-  - Excludes test utilities (`frontend/src/test/**`, `testUtils/**`)
-  - Excludes config files (`*.config.js`, `playwright.*.config.js`)
-  - Excludes entry points (`backend/cmd/api/**`, `frontend/src/main.tsx`)
-  - Excludes infrastructure code (`logger/**`, `metrics/**`, `trace/**`)
-  - Excludes type definitions (`*.d.ts`)
-  - Expected impact: Codecov total increases from 67% to 82-85%
-- **Build Strategy**: Simplified to Docker-only deployment model
-  - GoReleaser now used exclusively for changelog generation (not binary distribution)
-  - All deployment via Docker images (Docker Hub and GHCR)
-  - Removed standalone binary builds for macOS, Windows, and Linux
-  - DEB/RPM packages removed from release workflow
-  - Users should use `docker pull wikid82/charon:latest` or `ghcr.io/wikid82/charon:latest`
-  - See [Getting Started Guide](https://wikid82.github.io/charon/getting-started) for Docker installation instructions
-- **Backend**: Introduced `ProxyHostServiceInterface` for improved testability (PR #583)
-  - Import handler now uses interface-based dependency injection
-  - Enables mocking of proxy host service in unit tests
-  - Coverage improvement: 43.7% → 86.2% on `import_handler.go`
-
-### Added
-
-- **Performance Documentation**: Added comprehensive feature flags endpoint performance guide
-  - File: `docs/performance/feature-flags-endpoint.md`
-  - Covers architecture decisions, benchmarking, monitoring, and troubleshooting
-  - Documents N+1 query pattern elimination and transaction wrapping optimization
-  - Includes metrics tracking (P50/P95/P99 latency before/after optimization)
-  - Provides guidance for E2E test integration and timeout strategies
-- **E2E Test Helpers**: Enhanced Playwright test infrastructure for feature flag toggle tests
-  - `waitForFeatureFlagPropagation()` - Polls API until expected state confirmed (30s timeout)
-  - `retryAction()` - Exponential backoff retry wrapper (3 attempts: 2s, 4s, 8s delays)
-  - Condition-based polling replaces hard-coded waits for improved reliability
-  - Added comprehensive edge case tests (concurrent toggles, network failures, rollback)
-  - See `tests/utils/wait-helpers.ts` for implementation details
-
-### Fixed
-
-- **CI/CD Workflows**: Fixed multiple GitHub Actions workflow failures
-  - **Nightly Build**: Resolved GoReleaser macOS cross-compilation failure by properly configuring Zig toolchain
-  - **Playwright E2E**: Fixed test failures by ensuring admin backend service availability and proper Docker networking
-  - **Trivy Scan**: Fixed invalid Docker image reference format by adding PR number validation and branch name sanitization
-  - Resolution Date: January 30, 2026
-  - See action failure docs in `docs/actions/` for technical details
-- **E2E Security Tests**: Added CI-specific timeout multipliers to prevent flaky tests in GitHub Actions (PR #583)
-  - Affected tests: `emergency-token.spec.ts`, `combined-enforcement.spec.ts`, `waf-enforcement.spec.ts`, `emergency-server.spec.ts`
-  - Tests now use environment-aware timeouts (longer in CI, shorter locally)
-- **Frontend Accessibility**: Added missing `data-testid` attribute to Multi-site Import button (PR #583)
-  - File: `ImportCaddy.tsx` - Added `data-testid="multi-site-import-button"`
-  - File: `ImportSitesModal.tsx` - Added accessibility attributes for improved screen reader support
-- **Backend Tests**: Fixed skipped `import_handler_test.go` test preventing coverage measurement (PR #583)
-  - Introduced `ProxyHostServiceInterface` enabling proper mocking
-  - Coverage improved from 43.7% to 86.2% on import handler
-- **E2E Test**: Fixed incorrect assertion in `caddy-import-debug.spec.ts` that expected multi-file guidance text (PR #583)
-  - Updated to correctly validate import errors are surfaced
-- **CI/CD**: Relaxed Codecov patch coverage target from 100% to 85% for achievable threshold (PR #583)
-
-### Added
-
-- **Frontend Tests**: Added `ImportCaddy-handlers.test.tsx` with 23 test cases (PR #583)
-  - Covers loading/disabled button states, upload handlers, review table, success modal navigation
-  - `ImportCaddy.tsx` coverage improved from 32.6% to 78.26%
-
-- **Frontend Tests**: Added `Uptime.test.tsx` with 9 test cases
-  - Covers loading/empty states, monitor grouping logic, modal interactions, status badge rendering
-
-- **Security test helpers for Playwright E2E tests to prevent ACL deadlock** (PR #XXX)
-  - New `tests/utils/security-helpers.ts` module with utilities for capturing/restoring security state
-  - Functions: `getSecurityStatus`, `setSecurityModuleEnabled`, `captureSecurityState`, `restoreSecurityState`, `withSecurityEnabled`, `disableAllSecurityModules`
-  - Enables guaranteed cleanup via Playwright's `test.afterAll()` fixture, preventing test suite deadlock when ACL is left enabled
-  - See [Security Test Helpers Guide](docs/testing/security-helpers.md) for usage examples
-
-- **Phase 6: User Management UI Enhancements** (PR #XXX)
-  - **Resend Invite**: Administrators can resend invitation emails to pending users via new `POST /api/v1/users/{id}/resend-invite` endpoint
-  - **Email Validation**: Client-side email format validation in the invite modal with visible error messages
-  - **Modal Keyboard Navigation**: Escape key now closes invite and permissions modals for improved accessibility
-  - **7 E2E Tests Enabled**: Previously skipped user management tests now pass
-
-### Fixed
-
-- **CRITICAL**: Fixed Caddy validator rejecting emergency+main route pattern affecting all 18 proxy hosts
-  - Validator now allows duplicate hosts when one has path matchers and one doesn't (emergency bypass pattern)
-  - Updated validator logic to track path configuration per host instead of simple boolean
-  - All proxy hosts restored with 39 routes loaded in Caddy
-  - Comprehensive test suite added with 100% coverage on validator.go and config.go
-- **CrowdSec integration tests failing when hub API is unavailable (404 fallback)**: Integration test script now gracefully handles hub unavailability by checking for hub-sourced presets and falling back to curated presets when the hub returns 404. Added 404 status code to fallback conditions in `hub_sync.go` to enable automatic mirror URL fallback.
-- **GitHub Actions workflows failing with 'invalid reference format' for feature branches containing slashes**: Branch names like `feature/beta-release` now properly sanitized (replacing `/` with `-`) in Docker image tags and artifact names across `playwright.yml`, `supply-chain-verify.yml`, and `supply-chain-pr.yml` workflows
-- **PermissionsModal State Synchronization**: Fixed React anti-pattern where `useState` was used like `useEffect`, causing potential stale state when editing different users' permissions
-
-### Added
-
-- **Phase 4: Security Module Toggle Actions**: Security dashboard toggles for ACL, WAF, and Rate Limiting are now fully functional (PR #XXX)
-  - **Toggle Functionality**: Enable/disable security modules directly from the Security Dashboard UI
-  - **Backend Cache Layer**: 60-second TTL in-memory cache for settings to minimize database queries in middleware
-  - **Auto Config Reload**: Caddy configuration automatically reloads when security settings change
-  - **Optimistic Updates**: Toggle changes reflect instantly in the UI with proper rollback on failure
-  - **Mode Preservation**: WAF and Rate Limiting mode settings (detection/prevention, log/block) preserved during toggles
-  - **8 E2E Tests Enabled**: Previously skipped security dashboard tests now pass
-  - See [Phase 4 Specification](docs/plans/phase4_security_toggles_spec.md) for implementation details
-
-### Security
-
-- **CRITICAL**: Fixed CVE-2025-68156 by upgrading expr-lang/expr to v1.17.7
-  - **Component**: expr-lang/expr (used by CrowdSec for expression evaluation in scenarios and parsers)
-  - **Vulnerability**: Regular Expression Denial of Service (ReDoS)
-  - **Severity**: HIGH (CVSS score: 7.5)
-  - **Impact**: Malicious regular expressions in CrowdSec configurations could cause CPU exhaustion
-  - **Resolution Date**: January 11, 2026
-  - **Verification Methods**:
-    - Binary inspection: `go version -m ./cscli` confirms v1.17.7 in production artifacts
-    - Trivy scan: 0 HIGH/CRITICAL vulnerabilities in Charon application code
-    - Source build: Custom Dockerfile builds CrowdSec from patched source
-  - **Test Coverage**: Backend 86.2%, Frontend 85.64% (all tests passing)
-  - **Status**: ✅ Patched and verified in production build
-  - See [CrowdSec Source Build Documentation](docs/plans/crowdsec_source_build.md) for technical details
-
-### Added
-
-- **Pre-commit hook for fast Go linters (staticcheck, govet, errcheck, ineffassign, unused)**
-  - New config file: `backend/.golangci-fast.yml` (lightweight for pre-commit)
-  - VS Code tasks: "Lint: Staticcheck (Fast)" and "Lint: Staticcheck Only"
-  - Makefile targets: `lint-fast` and `lint-staticcheck-only`
-  - Comprehensive troubleshooting guide for staticcheck failures in copilot-instructions.md
-- **golangci-lint installation instructions** in CONTRIBUTING.md
-- Implementation summary: docs/implementation/STATICCHECK_BLOCKING_INTEGRATION_COMPLETE.md
-
-### Changed
-
-- Upgrade CrowdSec from 1.7.5 to 1.7.6
-- **BREAKING:** Commits are now BLOCKED if staticcheck or other fast linters find issues
-  - Pre-commit hooks now run golangci-lint with essential linters (~11s runtime)
-  - Test files (`_test.go`) excluded from staticcheck (matches CI behavior)
-  - Emergency bypass available with `git commit --no-verify` (use sparingly)
-
-### Testing
-
-- **E2E Test Suite Remediation (Phase 4)**: Fixed critical E2E test infrastructure issues to achieve 100% pass rate
-  - **Pass rate improvement**: 37% → 100% (1317 tests passing, 174 skipped)
-  - **TestDataManager**: Fixed to skip "Cannot delete your own account" error during cleanup
-  - **Toast selectors**: Updated wait helpers to use `data-testid="toast-success/error"`
-  - **API mock paths**: Updated 27 mock paths from `/api/` to `/api/v1/` in notification and SMTP settings tests
-  - **User management**: Fixed email input selector and added appropriate timeouts
-  - **Test organization**: 33 tests marked as `.skip()` for unimplemented or flaky features pending resolution
-  - See [E2E Phase 4 Complete](docs/implementation/E2E_PHASE4_REMEDIATION_COMPLETE.md) for details
-
-### Fixed
-
-- **CI**: Fixed Docker image artifact save failing with "reference does not exist" error in PR builds
-  - Root cause: Manual image tag reconstruction did not match actual tag applied by docker/build-push-action
-  - Solution: Use exact tag from docker/metadata-action output instead of reconstructing
-  - Impact: PR builds now successfully save image artifacts for supply chain verification
-  - Downstream fix: Enables verify-supply-chain-pr job to run correctly on all PRs
-- **Docs-to-Issues Workflow**: Resolved issue where PR status checks didn't appear when workflow ran (PR #461)
-  - Removed `[skip ci]` flag from workflow commit message to enable CI validation on PRs
-  - Maintained infinite loop protection via path filters (`!docs/issues/created/**`) and bot guard
-  - All CI checks now run properly on PRs created by automated issue processing
-  - Zero security risks, comprehensive validation completed
-  - See [Docs-to-Issues Fix Implementation Summary](docs/implementation/DOCS_TO_ISSUES_FIX_2026-01-11.md)
-- **CI Workflow Documentation**: Resolved GitHub Advanced Security false positive warnings and clarified supply chain verification behavior (PR #461)
-  - Documented workflow migration from `docker-publish.yml` to `docker-build.yml` (Dec 21, 2025)
-  - Added explanatory comments to all security scanning workflows
-  - Fixed `supply-chain-verify.yml` to trigger on ALL branches (removed GitHub Actions branch filter limitation)
-  - Updated SECURITY.md with comprehensive scanning coverage documentation
-  - All security scanning verified as active with zero gaps
-  - See [CI Workflow Fixes Implementation Summary](docs/implementation/CI_WORKFLOW_FIXES_2026-01-11.md)
-
-### Added
-
-- **Supply Chain Security**: Comprehensive supply chain security implementation with cryptographic verification (PR #XXX)
-  - **Cosign Signatures**: All container images cryptographically signed with keyless Sigstore Cosign
-  - **SLSA Provenance**: SLSA Level 3 compliant build provenance attestation for verifiable builds
-  - **SBOM Generation**: Software Bill of Materials in SPDX format for all releases
-  - **Transparency Log**: All signatures recorded in public Rekor transparency log
-  - **VS Code Integration**: Three new agent skills for developers:
-    - `security-verify-sbom`: Verify SBOM contents and check for vulnerabilities
-    - `security-sign-cosign`: Sign container images with Cosign
-    - `security-slsa-provenance`: Generate SLSA provenance attestation
-  - **Automated Verification**: Tasks integrated into development workflow
-  - **Documentation**: Complete user and developer guides for verification and usage
-  - See [Supply Chain Security User Guide](docs/guides/supply-chain-security-user-guide.md) for verification instructions
-  - See [Supply Chain Security Developer Guide](docs/guides/supply-chain-security-developer-guide.md) for development workflow
-
-### Verified
-
-- **React 19 Compatibility:** Confirmed React 19.2.3 works correctly with lucide-react@0.562.0
-  - Comprehensive diagnostic testing shows no production runtime errors
-  - All 1403 unit tests pass, production build succeeds
-  - Issue likely caused by browser cache or stale Docker image (user-side)
-  - Added troubleshooting guide for "Cannot set properties of undefined" errors
-
-### Added
-
-- **DNS Challenge Support for Wildcard Certificates**: Full support for wildcard SSL certificates using DNS-01 challenges (Issue #21, PR #460, #461)
-  - **Secure DNS Provider Management**: Add, edit, test, and delete DNS provider configurations with AES-256-GCM encrypted credentials
-  - **10+ Supported Providers**: Cloudflare, AWS Route53, DigitalOcean, Google Cloud DNS, Azure DNS, Namecheap, GoDaddy, Hetzner, Vultr, DNSimple
-  - **Automated Certificate Issuance**: Wildcard domains (e.g., `*.example.com`) automatically use DNS-01 challenges via configured providers
-  - **Pre-Save Testing**: Test DNS provider credentials before saving to catch configuration errors early
-  - **Dynamic Configuration**: Provider-specific credential fields with hints and documentation links
-  - **Comprehensive Documentation**: Setup guides for major providers and troubleshooting documentation
-  - **Security First**: Credentials never exposed in API responses, encrypted at rest with CHARON_ENCRYPTION_KEY
-  - See [DNS Providers Guide](docs/guides/dns-providers.md) for setup instructions
-- **Universal JSON Template Support for Notifications**: JSON payload templates (minimal, detailed, custom) are now available for all notification services that support JSON payloads, not just generic webhooks (PR #XXX)
-  - **Discord**: Rich embeds with colors, fields, and custom formatting
-  - **Slack**: Block Kit messages with sections and interactive elements
-  - **Gotify**: JSON payloads with priority levels and extras field
-  - **Generic webhooks**: Complete control over JSON structure
-  - **Template variables**: `{{.Title}}`, `{{.Message}}`, `{{.EventType}}`, `{{.Severity}}`, `{{.HostName}}`, `{{.Timestamp}}`, and more
-  - See [Notification Guide](docs/features/notifications.md) for examples and migration guide
-- **Improved Uptime Monitoring Reliability**: Enhanced uptime monitoring system with debouncing and race condition prevention (PR #XXX)
-  - **Failure debouncing**: Requires 2 consecutive failures before marking host as "down" to prevent false alarms from transient issues
-  - **Increased timeout**: TCP connection timeout raised from 5s to 10s for slow networks and containers
-  - **Automatic retries**: Up to 2 retry attempts with 2-second delay between attempts
-  - **Synchronized checks**: All host checks complete before database reads, eliminating race conditions
-  - **Concurrent processing**: All hosts checked in parallel for better performance
-  - See [Uptime Monitoring Guide](docs/features/uptime-monitoring.md) for troubleshooting tips
-
-### Changed
-
-- **CrowdSec Upgrade**: Upgraded CrowdSec from 1.7.4 to 1.7.5 (maintenance release, no breaking changes)
-  - Key improvements: PAPI allowlist check, CAPI token reuse improvements
-- **Caddy Upgrade**: Upgraded Caddy from v2.10.2 to v2.11.0-beta.2
-- **Dependency Cleanup**: Removed manual quic-go v0.57.1 patch (now included upstream at v0.58.0)
-- **Dependency Cleanup**: Removed manual smallstep/certificates v0.29.0 patch (now included upstream)
-- **Notification Backend Refactoring**: Renamed internal function `sendCustomWebhook` to `sendJSONPayload` for clarity (no user impact)
-- **Frontend Template UI**: Template configuration UI now appears for Discord, Slack, Gotify, and generic webhooks (previously webhook-only)
-
-### Fixed
-
-- **Uptime False Positives**: Resolved issue where proxy hosts were incorrectly reported as "down" after page refresh due to timing and race conditions
-- **Transient Failure Alerts**: Single network hiccups no longer trigger false down notifications due to debouncing logic
-
-### Test Coverage Improvements
-
-- **Test Coverage Improvements**: Comprehensive test coverage enhancements across backend and frontend (PR #450)
-  - Backend coverage: **86.2%** (exceeds 85% threshold)
-  - Frontend coverage: **87.27%** (exceeds 85% threshold)
-  - Added SSRF protection tests for security notification handlers
-  - Enhanced integration tests for CrowdSec, WAF, and ACL features
-  - Improved IP validation test coverage (IPv4/IPv6 comprehensive)
-  - See [PR #450 Implementation Summary](docs/implementation/PR450_TEST_COVERAGE_COMPLETE.md)
-
-### Security
-
-- **Dependency Updates**: quic-go v0.58.0 with security fixes (included via Caddy v2.11.0-beta.2 upgrade)
-- **CRITICAL**: Complete Server-Side Request Forgery (SSRF) remediation with defense-in-depth architecture (CWE-918, PR #450)
-  - **CodeQL CWE-918 Fix**: Resolved taint tracking issue in `url_testing.go:152` by introducing explicit variable to break taint chain
-  - Variable `requestURL` now receives validated output from `security.ValidateExternalURL()`, eliminating CodeQL false positive
-  - **Phase 1**: Runtime SSRF protection via `url_testing.go` with connection-time IP validation
-    - Implemented custom `ssrfSafeDialer()` with atomic DNS resolution and IP validation
-    - All resolved IPs validated before connection establishment (prevents DNS rebinding/TOCTOU attacks)
-    - Validates 13+ CIDR ranges: RFC 1918 private networks, cloud metadata endpoints (169.254.0.0/16), loopback, and link-local addresses
-    - HTTP client enforces 5-second timeout and max 2 redirects
-  - **Phase 2**: Handler-level SSRF pre-validation in `settings_handler.go` TestPublicURL endpoint
-    - Pre-connection validation using `security.ValidateExternalURL()` breaks CodeQL taint chain
-    - Rejects embedded credentials (prevents URL parser differential attacks like `http://evil.com@127.0.0.1/`)
-    - Returns HTTP 200 with `reachable: false` for SSRF blocks (maintains API contract)
-    - Admin-only access with comprehensive test coverage (31/31 assertions passing)
-  - **Three-Layer Defense-in-Depth Architecture**:
-    - Layer 1: `security.ValidateExternalURL()` - URL format and DNS pre-validation
-    - Layer 2: `network.NewSafeHTTPClient()` - Connection-time IP re-validation via custom dialer
-    - Layer 3: Redirect validation - Each redirect target validated before following
-  - **New SSRF-Safe HTTP Client API** (`internal/network` package):
-    - `network.NewSafeHTTPClient()` with functional options pattern
-    - Options: `WithTimeout()`, `WithAllowLocalhost()`, `WithAllowedDomains()`, `WithMaxRedirects()`, `WithDialTimeout()`
-    - Prevents DNS rebinding attacks by validating IPs at TCP dial time
-  - **Additional Protections**:
-    - Security notification webhooks validated to prevent SSRF attacks
-    - CrowdSec hub URLs validated against allowlist of official domains
-    - GitHub update URLs validated before requests
-  - **Monitoring**: All SSRF attempts logged with HIGH severity
-  - **Validation Strategy**: Fail-fast at configuration save + defense-in-depth at request time
-  - Pre-remediation CVSS score: 8.6 (HIGH) → Post-remediation: 0.0 (vulnerability eliminated)
-  - CodeQL Critical finding resolved - all security tests passing
-  - See [SSRF Protection Guide](docs/security/ssrf-protection.md) for complete documentation
-
-### Changed
-
-- **BREAKING**: `UpdateService.SetAPIURL()` now returns error (internal API only, does not affect users)
-- Security notification service now validates webhook URLs before saving and before sending
-- CrowdSec hub sync validates hub URLs against allowlist of official domains
-- URL connectivity testing endpoint requires admin privileges and applies SSRF protection
-
-### Enhanced
-
-- **Sidebar Navigation Scrolling**: Sidebar menu area is now scrollable, preventing the logout button from being pushed off-screen when multiple submenus are expanded. Includes custom scrollbar styling for better visual consistency.
-- **Fixed Header Bar**: Desktop header bar now remains visible when scrolling the main content area, improving navigation accessibility and user experience.
-
-### Changed
-
-- **Repository Structure Reorganization**: Cleaned up root directory for better navigation
-  - Moved docker-compose files to `.docker/compose/`
-  - Moved `docker-entrypoint.sh` to `.docker/`
-  - Moved 16 implementation docs to `docs/implementation/`
-  - Deleted test artifacts (`block_test.txt`, `caddy_*.json`, etc.)
-  - Added `.github/instructions/structure.instructions.md` for ongoing structure enforcement
-
-### Added
-
-- **Bulk Apply Security Header Profiles**: Apply or remove security header profiles from multiple proxy hosts simultaneously via the Bulk Apply modal
-- **Standard Proxy Headers**: Charon now adds X-Real-IP, X-Forwarded-Proto, X-Forwarded-Host, and
-  X-Forwarded-Port headers to all proxy hosts by default. This enables proper client IP detection,
-  HTTPS enforcement, and logging in backend applications.
-  - New feature flag: `enable_standard_headers` (default: true for new hosts, false for existing)
-  - UI: Checkbox in proxy host form with info banner explaining backward compatibility
-  - Bulk operations: Toggle available in bulk apply modal for enabling/disabling across multiple hosts
-  - Migration path: Existing hosts preserve old behavior (headers disabled) for backward compatibility
-  - Note: X-Forwarded-For is handled natively by Caddy and not explicitly set by Charon
-
-### Changed
-
-- **Backend Applications**: Applications behind Charon proxies will now receive client IP and protocol
-  information via standard headers when the feature is enabled
-
-### Fixed
-
-- Fixed 500 error when saving proxy hosts caused by invalid `trusted_proxies` structure in Caddy configuration
-- Removed redundant handler-level `trusted_proxies` (server-level configuration already provides global
-  IP spoofing protection)
-- Fixed proxy host save failure (500 error) when updating enable_standard_headers, forward_auth_enabled,
-  or waf_disabled fields
-- Fixed auth pass-through failure for Seerr/Overseerr caused by missing standard proxy headers
-
-### Security
-
-- **Trusted Proxies**: Caddy configuration now always includes `trusted_proxies` directive when proxy
-  headers are enabled, preventing IP spoofing attacks by ensuring headers are only trusted from Charon
-  itself
-
-### Migration Guide for Existing Users
-
-Existing proxy hosts will have standard headers **disabled by default** to maintain backward compatibility
-with applications that may not expect or handle these headers correctly. To enable standard headers on
-existing hosts:
-
-#### Option 1: Enable on individual hosts
-
-1. Navigate to **Proxy Hosts**
-2. Click **Edit** on the desired host
-3. Scroll to the **Standard Proxy Headers** section
-4. Check the **"Enable Standard Proxy Headers"** checkbox
-5. Click **Save**
-
-#### Option 2: Bulk enable on multiple hosts
-
-1. Navigate to **Proxy Hosts**
-2. Select the checkboxes for hosts you want to update
-3. Click the **"Bulk Apply"** button at the top
-4. In the **Bulk Apply Settings** modal, find **"Standard Proxy Headers"**
-5. Toggle the switch to **ON**
-6. Check the **"Apply to selected hosts"** checkbox for this setting
-7. Click **"Apply Changes"**
-
-**What do these headers do?**
-
-- **X-Real-IP**: Provides the client's actual IP address (bypasses proxy IP)
-- **X-Forwarded-Proto**: Indicates the original protocol (http or https)
-- **X-Forwarded-Host**: Contains the original Host header from the client
-- **X-Forwarded-Port**: Indicates the original port number used by the client
-- **X-Forwarded-For**: Automatically managed by Caddy (shows chain of proxies)
-
-**Why the default changed:**
-
-Most modern web applications expect these headers for proper logging, security, and functionality. New
-proxy hosts will have this enabled by default to follow industry best practices.
-
-**When to keep headers disabled:**
-
-- Legacy applications that don't understand proxy headers
-- Applications with custom IP detection logic that might conflict
-- Security-sensitive applications where you want to control header injection manually