nexxo 5d64da1cb3 docs: hiding the site also hides the login page, and that has a consequence ... The gate exempts admin/* so the console keeps working, but /admin sends a guest to /login and /login is not the console — so with the site hidden and no VPN yet, an operator cannot sign in to flip the switch back. Found while bringing up the live server. The mechanism for it already exists and is the right one: TRUSTED_RANGES. What does NOT work is exempting the login flow by hostname, which was the obvious patch — a Host header is chosen by the caller, so one forged header would have lifted the gate for every route, portal included. Codex caught that; the comment now says why the narrow-looking option is the wrong one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-26 19:27:51 +02:00
..
Actions	fix(billing): hold only what cannot be matched, and let migrations roll back	2026-07-26 13:57:11 +02:00
Console	feat(billing): Stripe owns the billing cycle, we own capability	2026-07-26 13:36:28 +02:00
Http	docs: hiding the site also hides the login page, and that has a consequence	2026-07-26 19:27:51 +02:00
Livewire	feat(billing): a proof register, and modules frozen at their booked price	2026-07-26 13:07:34 +02:00
Mail	fix(admin): confirm maintenance delivery via MessageSent (retryable until sent); guard resend/cancel on derived state; fix flaky non-unique host wg_ip	2026-07-25 16:14:01 +02:00
Models	feat(billing): Stripe owns the billing cycle, we own capability	2026-07-26 13:36:28 +02:00
Notifications	fix(engine-b): default-deny firewall, disk-based capacity, synchronous credential mail	2026-07-25 12:39:15 +02:00
Policies	fix(vpn): losing the operator roles closes the owner doors by itself	2026-07-25 22:50:13 +02:00
Providers	feat(billing): Stripe owns the billing cycle, we own capability	2026-07-26 13:36:28 +02:00
Provisioning	fix(billing): a paid order opens a contract, and provisioning obeys it	2026-07-26 11:10:00 +02:00
Services	feat(deploy): releases you can pin to, and a version that tells the truth	2026-07-26 15:21:38 +02:00
Support	feat(traffic): meter the monthly allowance, show it, throttle instead of blocking	2026-07-25 23:33:47 +02:00