feat: production hardening + password reset, metrics, signed webhooks

Security hardening (CRITICAL/HIGH from production-readiness audit):
- Require strong JWT_SECRET + separate INTEGRATION_ENCRYPTION_KEY at boot;
  refuse placeholder defaults. Integration key now derived via HKDF.
- SSRF guard (src/lib/server/utils/safeFetch.ts): DNS-resolves and rejects
  RFC1918/loopback/link-local/IPv4-mapped IPv6/decimal-IP/cloud-metadata.
  Manual redirect handling re-validates each 3xx Location hop. Applied to
  healthcheck, RSS, calendar, metric, system-stats, camera, notifications,
  discovery, apps/preview, and all integration clients.
- API tokens, session refresh tokens, invite tokens, password-reset tokens
  switched from bcrypt to sha256 with @unique indexed lookup (O(1) instead
  of O(N) bcrypt-compares; eliminates a trivial DoS).
- Refresh-token reuse detection via Session.previousTokenHash.
- Permission checks on App PATCH/DELETE and Widget/Section endpoints.
- /api/integrations/alerts now requires auth.
- SVG uploads sanitized through DOMPurify (svg profile, scheme allow-list).
- Custom CSS sanitizer + selector scoping (decodes CSS unicode escapes
  before pattern match, drops forbidden at-rules incl. @import without
  whitespace, strips dangerous url() args). Scoped to .custom-css-scope.
- Backup restore validates SQLite magic header, takes a safety snapshot,
  uses atomic rename, re-applies pragmas.
- SQLite WAL + busy_timeout + foreign_keys + synchronous=NORMAL at startup.
- Healthcheck scheduler was dead code; wired in hooks.server.ts with
  HMR-safe singleton, concurrency cap, overlap prevention, retention jobs
  for AppClick/Notification/AuditLog. Composite indexes added on hot paths.
- Security headers (CSP, HSTS-on-https, X-Frame-Options, Permissions-Policy)
  emitted on every response.
- Account-enumeration mitigation on login (dummy bcrypt on no-user/oauth
  branches) + rate limiting on login/register/onboarding/refresh/invite/
  password-reset.
- OAuth callback sanitizes IdP error_description before echoing.

New features:
- Custom +error.svelte pages (root + boards + admin) via shared
  ErrorState component. Inverted hierarchy (status as label, title as hero).
- /forgot-password + /reset-password + admin-mediated /admin/password-resets
  page. SHA256 tokens, 24h TTL, all sessions revoked on apply.
- /invite page for manual invite-token redemption.
- /api/metrics Prometheus exposition with optional METRICS_TOKEN bearer
  auth. Counters for login/healthcheck/notification/integration; gauges
  for users/boards/apps + per-status app counts.
- Webhook HMAC-SHA256 signing for HTTP notification channels (optional
  shared secret + configurable signature header, default X-Signature-256).
- PATCH /api/users/me/password for self-service password change.
- Persistent uploads at /app/data/uploads with served-from-volume handler
  at /uploads/[...path]. SVGs served with CSP: sandbox.
- /api/health does a DB ping; returns 503 on disconnect.
- Public /status filtered to guest-accessible-board apps when unauthenticated.
- Audit log coverage: LOGIN_SUCCESS/FAILED, LOGOUT, OAUTH_LOGIN,
  OAUTH_USER_PROVISIONED, SESSION_REVOKED, API_TOKEN_*, INVITE_*,
  APP_UPDATED, PASSWORD_CHANGED, PASSWORD_RESET_*.

Performance:
- Board page: removed double findAll() over-fetch; include links + appTags
  in board query; widgets lazy-loaded via dynamic imports (marked,
  DOMPurify, hls.js, integration renderers).
- uptimeService.getAllAppsUptime: single batched query instead of N+1.
- 30s in-memory user-locals cache; invalidated on user mutation.
- pruneOldStatuses: single window-function DELETE instead of N+1.

Code quality:
- Typed error classes (NotFoundError, PermissionError, RateLimitError,
  IntegrationError) with toHttpError mapper.
- Locals.user shape exposes avatarUrl and narrows role via guard.
- App input types derived from Zod schemas via z.infer.
- 274 tests passing (up from 212); 62 new tests covering SSRF guard,
  CSS sanitizer, SVG sanitizer, rate limiter.

CI / Docker / config:
- Test workflow adds build, docker-build, audit jobs. Release workflow
  uses buildx multi-arch (amd64+arm64) with provenance + SBOM.
- Dockerfile uses tini, multi-stage prune, persistent uploads dir, single
  prisma migrate deploy (no destructive db push fallback).
- docker-compose: JWT_SECRET + INTEGRATION_ENCRYPTION_KEY required at
  startup, log rotation, resource limits.
- README documents breaking-change upgrade path.

Bug fixes from UI/UX review:
- ~55 missing i18n keys added to en/ru (auth flows, error pages, admin
  nav, register invite banner, settings.card_style).
- Hardcoded English on login replaced with $t('auth.remember_me').
- Admin nav uses i18n keys; mobile horizontal-scroll layout.
- Page <title> tags standardized.
- Password-resets: separated error/info/success surfaces, ConfirmDialog
  replaces window.confirm.
- Auth pages have matching lucide icon badges.
- Webhook secret has eye toggle and monospace input.
- text-green-500 → text-emerald-500 to match codebase convention.

Pre-existing CI lint failures cleaned up (31 errors → 0): each-key
attributes added, unused-svelte-ignore comments removed, two any casts
typed, dead skeleton components removed, /boards/[id]/edit redirect to
inline edit mode.

Tests: 274 / 274 passing
Type check: 0 errors / 0 warnings
Build: green

src/lib/components/notifications/NotificationChannelForm.svelte

@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { Eye, EyeOff } from 'lucide-svelte';
 	import { NotificationType } from '$lib/utils/constants.js';
 
 	interface ChannelData {
@@ -28,6 +29,9 @@
 	let telegramChatId = $state('');
 	let httpUrl = $state('');
 	let httpMethod = $state('POST');
+	let httpSecret = $state('');
+	let httpSignatureHeader = $state('');
+	let showHttpSecret = $state(false);
 
 	// Parse existing config
 	if (channel?.config) {
@@ -47,6 +51,8 @@
 				case 'http':
 					httpUrl = parsed.url ?? '';
 					httpMethod = parsed.method ?? 'POST';
+					httpSecret = parsed.secret ?? '';
+					httpSignatureHeader = parsed.signatureHeader ?? '';
 					break;
 			}
 		} catch {
@@ -62,8 +68,14 @@
 				return JSON.stringify({ webhookUrl: slackWebhookUrl });
 			case 'telegram':
 				return JSON.stringify({ botToken: telegramBotToken, chatId: telegramChatId });
-			case 'http':
-				return JSON.stringify({ url: httpUrl, method: httpMethod });
+			case 'http': {
+				// Only include secret/signatureHeader when set, to keep the stored
+				// config minimal and avoid encrypting empty strings.
+				const cfg: Record<string, string> = { url: httpUrl, method: httpMethod };
+				if (httpSecret) cfg.secret = httpSecret;
+				if (httpSignatureHeader) cfg.signatureHeader = httpSignatureHeader;
+				return JSON.stringify(cfg);
+			}
 			default:
 				return '{}';
 		}
@@ -207,6 +219,55 @@
 					<option value="PATCH">PATCH</option>
 				</select>
 			</div>
+			<div>
+				<label for="http-secret" class="mb-1 block text-sm font-medium text-foreground">
+					Webhook secret <span class="text-xs font-normal text-muted-foreground">(optional)</span>
+				</label>
+				<div class="relative">
+					<input
+						id="http-secret"
+						type={showHttpSecret ? 'text' : 'password'}
+						bind:value={httpSecret}
+						placeholder="Shared secret for HMAC-SHA256 signature"
+						autocomplete="off"
+						class="w-full rounded-md border border-input bg-background px-3 py-2 pr-10 font-mono text-sm text-foreground"
+					/>
+					<button
+						type="button"
+						onclick={() => (showHttpSecret = !showHttpSecret)}
+						aria-label={showHttpSecret ? 'Hide secret' : 'Show secret'}
+						class="absolute inset-y-0 right-0 flex items-center px-2.5 text-muted-foreground hover:text-foreground"
+					>
+						{#if showHttpSecret}
+							<EyeOff class="h-4 w-4" />
+						{:else}
+							<Eye class="h-4 w-4" />
+						{/if}
+					</button>
+				</div>
+				<p class="mt-1 text-xs text-muted-foreground">
+					When set, requests are signed with HMAC-SHA256 and sent as
+					<code class="rounded bg-muted/40 px-1">sha256=&lt;hex&gt;</code> in the signature header,
+					alongside an <code class="rounded bg-muted/40 px-1">X-Webhook-Timestamp</code>.
+				</p>
+			</div>
+			<div>
+				<label for="http-sig-header" class="mb-1 block text-sm font-medium text-foreground">
+					Signature header name
+					<span class="text-xs font-normal text-muted-foreground">(optional)</span>
+				</label>
+				<input
+					id="http-sig-header"
+					type="text"
+					bind:value={httpSignatureHeader}
+					placeholder="X-Signature-256"
+					autocomplete="off"
+					class="w-full rounded-md border border-input bg-background px-3 py-2 text-sm text-foreground"
+				/>
+				<p class="mt-1 text-xs text-muted-foreground">
+					Defaults to <code class="rounded bg-muted/40 px-1">X-Signature-256</code>. Override for receivers expecting a different name (e.g. <code class="rounded bg-muted/40 px-1">X-Hub-Signature-256</code>).
+				</p>
+			</div>
 		{/if}
 
 		<!-- Enabled Toggle -->
@@ -222,7 +283,7 @@
 
 		<!-- Test Result -->
 		{#if testResult}
-			<p class="text-sm {testResult.startsWith('Failed') ? 'text-destructive' : 'text-green-500'}">
+			<p class="text-sm {testResult.startsWith('Failed') ? 'text-destructive' : 'text-emerald-500'}">
 				{testResult}
 			</p>
 		{/if}

src/lib/components/notifications/NotificationHistory.svelte

@@ -25,7 +25,7 @@
 	async function loadNotifications(page: number = 1) {
 		loading = true;
 		try {
-			// eslint-disable-next-line svelte/prefer-svelte-reactivity
+			 
 			const params = new URLSearchParams({
 				limit: String(PAGE_SIZE),
 				offset: String((page - 1) * PAGE_SIZE)