5 Commits

Include renames

Author	SHA1	Message	Date
justme	a19e6548d3	feat: trust forwarded client addresses only from configured proxies (rate limit, audit, SSE) [CI] ... Docs: access.md covers the missing node-side Backend identity and the hash-first install flow.	2026-10-07 22:51:44 +08:00
justme	ff45ad086e	feat!: sensitive actions need a fresh passkey touch (elevation windows), plus login page hint cleanup [CI]	2026-10-07 22:29:24 +08:00
justme	6385c1b9a3	feat: sign in with a passkey (WebAuthn, ES256, discoverable credentials) and manage your passkeys [CI]	2026-10-07 21:57:19 +08:00
justme	ddb6608e32	feat!: capabilities replace API token scopes; every admin endpoint declares one, with a picker UI [CI]	2026-10-07 20:56:36 +08:00
justme	55b80f0a97	docs: access control and enrollment trust chain design [CI SKIP]	2026-10-07 20:45:23 +08:00