- Browser navigation now gets a self-contained login page (no JS, CSP
hardened, XSS-escaped, cross-origin POST rejected) instead of the native
Basic dialog; API clients keep 401 + WWW-Authenticate.
- Login/logout endpoints (/panel-auth/login, /panel-auth/logout) issue and
revoke the signed cookie, then 303 back to the original target.
- Structured audit log (login-ok/login-fail/logout/challenge/reject with
username, IP, UA, reason), default $DSH_HOME/panel-auth-audit.jsonl,
5MB rotation; X-Forwarded-For honored behind the reverse proxy.
- Function-plugin form, per-request config, fail-open when unconfigured.
- Tests extended to 15 flows including login page, login POST, logout,
audit assertions and XSS escaping.
dsh