boban c3788f5851 security: generate a random install password instead of the literal 'clusev' ... Rotation is optional now, so a well-known default ('clusev') would be a standing takeover credential on a fleet-root console. The installer now creates the first admin with a random Str::password(16), printed once on the CLUSEV_ADMIN_PASSWORD= line that install.sh already surfaces in the closing banner. must_change_password still nudges a rotation, but even if the operator keeps it, the secret is no longer guessable. Verified: the printed password authenticates + differs per install; noop-when-admin-exists is intact; Codex review APPROVED. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-02 19:33:52 +02:00
..
Console/Commands	security: generate a random install password instead of the literal 'clusev'	2026-07-02 19:33:52 +02:00
Events	fix(blade): garbled header on every signed-in page + private metrics channel (v0.4.1)	2026-06-14 08:34:07 +02:00
Http	feat(auth): make password rotation optional + correct the 2FA copy	2026-06-25 19:47:17 +02:00
Jobs	feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb	2026-06-12 00:31:50 +02:00
Livewire	feat(auth): drop password complexity — minimum is now just 6 characters	2026-06-26 06:29:33 +02:00
Models	security: harden proxy trust + model mass-assignment + terminal-token log hygiene	2026-06-26 07:16:10 +02:00
Notifications	fix(security): constant-time password-reset (flatten account-enumeration timing)	2026-06-15 19:16:30 +02:00
Providers	fix(assets): drop Vite preload hints (silence 'preloaded but not used')	2026-06-19 21:50:54 +02:00
Rules	feat(auth): ValidIpOrCidr validation rule	2026-06-20 17:42:06 +02:00
Services	refactor(metrics): interactive history chart — smooth, area, tooltip, instant ranges	2026-06-25 01:51:24 +02:00
Support	feat(release): deploy-to-public, promote-to-stable, yank actions (R5 + audit)	2026-06-23 03:26:14 +02:00