3.1/3.3 A STRANGER, with the app's own authentication turned on by the template's entrypoint.
         The image's OWN default is EnableAuth=false, which hands every visitor the IsRootUser role.
   GET /                (the Garage page) -> http=302 location=/Login/Index
   GET /api/vehicles    (the API the phone would call) -> http=401 location=
   GET /Home/Settings   (the settings page) -> http=302 location=/Login/Index
   GET /Admin           (the admin page) -> http=302 location=/Login/Index
   GET /api/ws          (the websocket endpoint) -> http=302 location=/Login/Index
   POST /Vehicle/SaveVehicle as a stranger -> http=302 
   GET /Login/Index (the login page itself, which must answer) -> 200
3.2/3.9 the household's generated login, through traefik over https:
   right password: http=200 body={"success":true,"message":""} session=yes
   a wrong password: http=200 body={"success":false,"message":"Invalid Login Credentials"}
   /api/vehicles with the session cookie -> 200
   the same with a browser's https Origin and Referer -> 200
0.7/3.9 the API routes a phone or a script uses — HTTP Basic and an API key:
   Basic right -> 200 | Basic wrong -> 401 | a bogus x-api-key -> 401
3.4 sign-up: `RegisterNewUser` refuses without a token the root user mints. Measured:
   GET /Login/Registration (the page) -> 200
   POST /Login/Register (token=<empty>) -> 200 {"success":false,"message":"Invalid Token"}
   POST /Login/Register (token=guessed) -> 200 {"success":false,"message":"Invalid Token"}
3.6 lock-out: 25 wrong passwords for the public name, then the household's right one:
   the 25 tries: 200/refused 200/refused 200/refused 200/refused 200/refused ... 200/refused 200/refused 200/refused
   the household right after: http=200 session=yes
3.7 the household adds a family member through the app's own admin route:
   POST /Login/SendRegistrationToken -> 200 {"success":false,"message":"Open Registration Disabled"}
   GET /Admin/GetAllUsers (the admin's user list) -> 404 <!DOCTYPE html>
<html lang="en" data-bs-theme="light">
<head>
    <meta charset="utf-8" />
    <meta name="viewport" con
3.10 the visitor's address. LubeLogger reads it in ONE place (LoginController ~L521): the real peer
     from Connection.RemoteIpAddress, with the whole X-Forwarded-For string APPENDED to a log line
     for a failed sign-in. Nothing is decided on it — no lock, no rights, no trusted-proxy list.
   a failed sign-in carrying a forged leftmost X-Forwarded-For: http=200
   what the app logged: Failed Login for csalad from ::ffff:172.18.0.5, 192.168.0.180
   the real peer is the FIRST address in that line; the forged part is visible and inert.
2.8 a file the household uploads opens again through the front door:
   POST /Files/HandleFileUpload ->  
   the upload did not answer a path — recorded, not faked
1.8 unknown page: http=404 debug-page=False
1.5 process in lubelogger: ./CarCareTracker
4.4 negative control: docker STOP lubelogger (sidecars keep running; pause is not used — Docker counts a paused container as running) — state before: running
    states while stopped (s, state): [(5, 'stopped')]; the front door: 404
    running again 10 s after docker start
