3.2 the three outcomes through traefik over https (the household's own browser route):
   grocy's documented default `admin` / `admin`  http=302 location=https://<host>/login?invalid=true session=no
   the box's generated password                  http=302 location=https://<host>/ session=yes
   a wrong password                              http=302 location=https://<host>/login?invalid=true session=no
   VERDICT 3.2: default refused=True, generated works=True, wrong refused=True
3.9 the browser form with an https Origin and a Referer, as a real browser sends it:
   right password with Origin+Referer: http=302 location=https://<host>/ session=yes
3.9 the API route a phone app uses (grocy's own REST API, GROCY-API-KEY header):
   no credentials -> 401 | a wrong API key -> 401 | the household's session -> 200 {"grocy_version":{"Version":"4.7.1","ReleaseDate":"2026-09-04"},"php_version":"8
0.7 a real API key, minted the way the household does it (the page the app offers), then used by itself:
   the minted key on /api/system/info -> 200 {"grocy_version":{"Version":"4.7.1","ReleaseDate":"2026-09-0 | on /api/stock -> 200
3.4 sign-up: grocy has no registration route at all. Measured:
   GET /register    -> 404
   GET /signup      -> 404
   GET /users/new   -> 404
   GET /user/new    -> 302
3.6 lock-out: 25 wrong passwords for the public name `admin`, then the household's right one:
   the 25 tries: 302/invalid 302/invalid 302/invalid 302/invalid 302/invalid ... 302/invalid 302/invalid 302/invalid
   the household right after: http=302 location=https://<host>/ session=yes
3.7 the household changes its own password and adds a family member (grocy's own routes):
   POST /api/users (a new family member) -> 204 
   the new member signs in: http=302 location=https://<host>/ session=yes
   and the FIRST member is still in after the stranger's 25 tries above: session=yes
3.10 the visitor's address. Grocy reads NO client address anywhere (repo-wide grep at v4.7.1 for
     REMOTE_ADDR / HTTP_X_FORWARDED_FOR / getClientIp: nothing), so nothing can be decided on a
     forged one. Measured anyway, with a forged leftmost entry through traefik:
   a failed sign-in carrying a forged X-Forwarded-For: http=302
   the app's log for that request: nothing — the address appears nowhere
2.8 a file the household uploads opens again through the front door (grocy's own file API):
   PUT /api/files/productpictures/<name> -> 204 
   GET it back -> 200, content matches=True
   the same GET with NO credentials -> 401 (must not be 200)
1.8 unknown page: http=404 debug-page=False
1.5 process in grocy: /package/admin/s6/command/s6-svscan -d4 -- /run/service
4.4 negative control: docker STOP grocy (sidecars keep running; pause is not used — Docker counts a paused container as running) — state before: running
    states while stopped (s, state): [(5, 'stopped')]; the front door: 404
    running again 10 s after docker start
