v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

CHANGELOG.md

@@ -1,3 +1,37 @@
+## v0.324.0 — a restore brings the database password back with the data; restic 0.19.1; dashboard hardening; three small fixes (2026-10-17)
+
+**MinAgent: 0.158.1** — the floor's, carried. Nothing here calls the agent. No golden (`09` §3 decision 250). Task:
+night brief 2026-10-16 → 17 (felhom.eu `REPORT-night-2026-10-17.md`).
+
+- **R-1106 + R-127 (b) — operator decision 1A: on a restore, the backup's database password wins.** New
+  `appbackup.DBCredentialVars` finds the app.yaml variables that feed a database service's `*_PASSWORD` (17 catalog
+  apps, 20 fields); `DBDataVolumes` the database's named volumes. The off-site full restore that keeps the app's
+  definition now writes the snapshot's password into the app's settings (`stacks.SetStackSecretValues`, load-then-save)
+  before the database starts — but only when the snapshot replays the database's data volume. The shared unit-restore
+  env (on-box restore, update rollback, „use kept data", off-site at the snapshot's version) keeps unit-wins and now
+  REFUSES, before any change, when neither the unit carries the password nor the current install is older than the
+  data; O4 never generates a database password again. Refusal sentence `err.backup.restore_no_db_password` (HU/EN).
+  R-926 on this path: the reinstall's `type: password` logins are recorded as restored-login fields (the page says to
+  use the old password). Tests `TestR1106_*` (backup, stacks), red-proved by six mutations. Catalog gate
+  `db-credentials` (app-catalog `af75dc0`).
+- **R-1107 — restic 0.19.1** (official binary, signed `SHA256SUMS`, both sums pinned). Fixtures for 0.14.0, 0.18.1 and
+  0.19.1 recaptured from one shared store; `TestR1105_*` runs every version against 0.14.0. One change read from its
+  notes and measured: a missing top-level backup path now exits 3 (was 0) — the capture's stat-filter keeps such paths
+  out of argv, so only a race reaches it, and that race now reads as a failure instead of a silent partial copy.
+- **R-1108** — `SetSMBPassword` applies changed files when the stack is running (a share added before the first
+  password is exported). `TestSambaPassword_ShareAddedBeforePasswordIsApplied` (+ companion).
+- **R-1065** — a successful Plex claim schedules the media wiring (`RunMediaWiringSoon`). `TestPlexClaim_TriggersMediaWiring`.
+- **R-1017** — the guard the `paths.go` comment named now exists: `TestNoBareDrivePathToUserdataDir`. It found one more
+  bare drive path: the remove dialog's „kept folders" list was empty on the system-drive fallback (`delete.go`
+  `userdataKept`) — fixed, `TestRemoveStack_R800_UserdataKeptOnSystemDrive`.
+- **R-983 (six items)** — sign-in `next` stays on the box (`safeBackPath`); `X-Frame-Options: DENY` + CSP
+  `frame-ancestors 'none'`; a sign-in try is counted before the password check (dashboard and family gate); the settings
+  password minimum is the claim's (12); reset-code requests limited (1 per visitor per minute, 3 per box per 15 min);
+  logout is a POST with CSRF (dashboard and family gate — the dashboard's sign-out link had done nothing since
+  2026-02-25). **R-976** — a password change or reset ends every dashboard, family and setup-gate session (the gate key
+  is rotated and saved); a family app cookie carries a per-app token, never the session. Tests `TestR983_*`,
+  `TestR976_*`, each red-proved. 135 i18n parity fixtures re-captured (the sign-out control; one minlength), 22 unchanged.
+
 ## v0.323.0 — Debian 13 with restic pinned outside the OS, re-proven; felhom-samba 1.2.0 on Alpine 3.24.2 (2026-10-16)
 
 **MinAgent: 0.158.1** — the floor's, carried. Nothing here calls the agent. No golden (`09` §3 decision 250). Task: