Add Gitea SSO, fix security audit findings, harden production defaults

Gitea SSO: cookie-based single sign-on via nginx auth_request — sets
cml_session cookie on login/refresh, validates via /api/auth/gitea-sso-validate,
injects X-WEBAUTH-USER header for reverse proxy auth. Dedicated GITEA_SSO_SECRET
and SERVICE_PASSWORD_SALT env vars isolate secret rotation.

Security fixes from March 30 audit: IDOR on ticketed events (requireEventOwnership
middleware), IDOR on action items (admin/assignee/creator check), path traversal
on photos (resolve-based validation), CSV upload size limit (5MB), shared calendar
email exposure removed.

Gitea provisioner: auto-sync docs repo collaborator access based on role
(CONTENT_ROLES get write, SUPER_ADMIN gets admin). Gitea client extended
with collaborator management API methods.

Production hardening: NODE_ENV defaults to production in docker-compose.prod.yml,
Grafana anonymous auth disabled, install.sh branch ref updated to main.

Admin UI: moved docs reset from toolbar to MkDocs Settings danger zone,
improved collab Ctrl+S to explicitly save + cache-bust preview.

MkDocs site rebuild with updated repo data, upgrade screenshots, and content.

Bunker Admin

mkdocs/docs/assets/repo-data/admin-changemaker.lite.json

@@ -7,10 +7,10 @@
   "stars_count": 0,
   "forks_count": 0,
   "open_issues_count": 0,
-  "updated_at": "2026-03-25T20:11:01-06:00",
+  "updated_at": "2026-03-30T11:54:37-06:00",
   "created_at": "2025-05-28T14:54:59-06:00",
   "clone_url": "https://gitea.bnkops.com/admin/changemaker.lite.git",
   "ssh_url": "git@gitea.bnkops.com:admin/changemaker.lite.git",
   "default_branch": "main",
-  "last_build_update": "2026-03-25T20:11:01-06:00"
+  "last_build_update": "2026-03-30T11:54:37-06:00"
 }

mkdocs/docs/assets/repo-data/anthropics-claude-code.json

@@ -4,13 +4,13 @@
   "description": "Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.",
   "html_url": "https://github.com/anthropics/claude-code",
   "language": "Shell",
-  "stars_count": 82863,
-  "forks_count": 6945,
-  "open_issues_count": 7902,
-  "updated_at": "2026-03-26T05:46:26Z",
+  "stars_count": 88332,
+  "forks_count": 9745,
+  "open_issues_count": 8343,
+  "updated_at": "2026-03-31T15:50:05Z",
   "created_at": "2025-02-22T17:41:21Z",
   "clone_url": "https://github.com/anthropics/claude-code.git",
   "ssh_url": "git@github.com:anthropics/claude-code.git",
   "default_branch": "main",
-  "last_build_update": "2026-03-26T00:31:05Z"
+  "last_build_update": "2026-03-31T14:35:57Z"
 }

mkdocs/docs/assets/repo-data/coder-code-server.json

@@ -4,13 +4,13 @@
   "description": "VS Code in the browser",
   "html_url": "https://github.com/coder/code-server",
   "language": "TypeScript",
-  "stars_count": 76836,
-  "forks_count": 6567,
-  "open_issues_count": 166,
-  "updated_at": "2026-03-26T04:51:01Z",
+  "stars_count": 76910,
+  "forks_count": 6575,
+  "open_issues_count": 172,
+  "updated_at": "2026-03-31T14:49:15Z",
   "created_at": "2019-02-27T16:50:41Z",
   "clone_url": "https://github.com/coder/code-server.git",
   "ssh_url": "git@github.com:coder/code-server.git",
   "default_branch": "main",
-  "last_build_update": "2026-03-25T23:42:46Z"
+  "last_build_update": "2026-03-31T00:00:24Z"
 }

mkdocs/docs/assets/repo-data/gethomepage-homepage.json

@@ -4,13 +4,13 @@
   "description": "A highly customizable homepage (or startpage / application dashboard) with Docker and service API integrations.",
   "html_url": "https://github.com/gethomepage/homepage",
   "language": "JavaScript",
-  "stars_count": 29142,
-  "forks_count": 1831,
-  "open_issues_count": 2,
-  "updated_at": "2026-03-26T04:32:12Z",
+  "stars_count": 29249,
+  "forks_count": 1833,
+  "open_issues_count": 0,
+  "updated_at": "2026-03-31T14:45:22Z",
   "created_at": "2022-08-24T07:29:42Z",
   "clone_url": "https://github.com/gethomepage/homepage.git",
   "ssh_url": "git@github.com:gethomepage/homepage.git",
   "default_branch": "dev",
-  "last_build_update": "2026-03-26T04:09:25Z"
+  "last_build_update": "2026-03-31T14:36:10Z"
 }

mkdocs/docs/assets/repo-data/go-gitea-gitea.json

@@ -4,13 +4,13 @@
   "description": "Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD",
   "html_url": "https://github.com/go-gitea/gitea",
   "language": "Go",
-  "stars_count": 54497,
-  "forks_count": 6492,
-  "open_issues_count": 2870,
-  "updated_at": "2026-03-26T05:41:32Z",
+  "stars_count": 54629,
+  "forks_count": 6518,
+  "open_issues_count": 2866,
+  "updated_at": "2026-03-31T15:12:57Z",
   "created_at": "2016-11-01T02:13:26Z",
   "clone_url": "https://github.com/go-gitea/gitea.git",
   "ssh_url": "git@github.com:go-gitea/gitea.git",
   "default_branch": "main",
-  "last_build_update": "2026-03-26T00:53:32Z"
+  "last_build_update": "2026-03-31T15:40:43Z"
 }

mkdocs/docs/assets/repo-data/knadh-listmonk.json

@@ -4,13 +4,13 @@
   "description": "High performance, self-hosted, newsletter and mailing list manager with a modern dashboard. Single binary app.",
   "html_url": "https://github.com/knadh/listmonk",
   "language": "Go",
-  "stars_count": 19343,
-  "forks_count": 1965,
-  "open_issues_count": 103,
-  "updated_at": "2026-03-26T04:23:08Z",
+  "stars_count": 19396,
+  "forks_count": 1977,
+  "open_issues_count": 91,
+  "updated_at": "2026-03-31T14:23:10Z",
   "created_at": "2019-06-26T05:08:39Z",
   "clone_url": "https://github.com/knadh/listmonk.git",
   "ssh_url": "git@github.com:knadh/listmonk.git",
   "default_branch": "master",
-  "last_build_update": "2026-03-26T04:23:38Z"
+  "last_build_update": "2026-03-31T05:18:48Z"
 }

mkdocs/docs/assets/repo-data/lyqht-mini-qr.json

@@ -4,13 +4,13 @@
   "description": "Create & scan cute qr codes easily \ud83d\udc7e",
   "html_url": "https://github.com/lyqht/mini-qr",
   "language": "Vue",
-  "stars_count": 1931,
-  "forks_count": 244,
-  "open_issues_count": 21,
-  "updated_at": "2026-03-26T02:38:23Z",
+  "stars_count": 1938,
+  "forks_count": 245,
+  "open_issues_count": 23,
+  "updated_at": "2026-03-31T12:32:17Z",
   "created_at": "2023-04-21T14:20:14Z",
   "clone_url": "https://github.com/lyqht/mini-qr.git",
   "ssh_url": "git@github.com:lyqht/mini-qr.git",
   "default_branch": "main",
-  "last_build_update": "2026-03-13T12:48:04Z"
+  "last_build_update": "2026-03-31T12:43:07Z"
 }

mkdocs/docs/assets/repo-data/n8n-io-n8n.json

@@ -4,13 +4,13 @@
   "description": "Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.",
   "html_url": "https://github.com/n8n-io/n8n",
   "language": "TypeScript",
-  "stars_count": 181103,
-  "forks_count": 56170,
-  "open_issues_count": 1416,
-  "updated_at": "2026-03-26T05:48:22Z",
+  "stars_count": 181869,
+  "forks_count": 56348,
+  "open_issues_count": 1447,
+  "updated_at": "2026-03-31T15:46:32Z",
   "created_at": "2019-06-22T09:24:21Z",
   "clone_url": "https://github.com/n8n-io/n8n.git",
   "ssh_url": "git@github.com:n8n-io/n8n.git",
   "default_branch": "master",
-  "last_build_update": "2026-03-26T05:30:58Z"
+  "last_build_update": "2026-03-31T15:47:22Z"
 }

mkdocs/docs/assets/repo-data/nocodb-nocodb.json

@@ -4,13 +4,13 @@
   "description": "\ud83d\udd25 \ud83d\udd25 \ud83d\udd25 A Free & Self-hostable Airtable Alternative",
   "html_url": "https://github.com/nocodb/nocodb",
   "language": "TypeScript",
-  "stars_count": 62543,
-  "forks_count": 4681,
-  "open_issues_count": 658,
-  "updated_at": "2026-03-26T05:48:04Z",
+  "stars_count": 62566,
+  "forks_count": 4703,
+  "open_issues_count": 665,
+  "updated_at": "2026-03-31T15:24:55Z",
   "created_at": "2017-10-29T18:51:48Z",
   "clone_url": "https://github.com/nocodb/nocodb.git",
   "ssh_url": "git@github.com:nocodb/nocodb.git",
   "default_branch": "develop",
-  "last_build_update": "2026-03-26T05:48:41Z"
+  "last_build_update": "2026-03-31T15:24:48Z"
 }

mkdocs/docs/assets/repo-data/ollama-ollama.json

@@ -4,13 +4,13 @@
   "description": "Get up and running with Kimi-K2.5, GLM-5, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.",
   "html_url": "https://github.com/ollama/ollama",
   "language": "Go",
-  "stars_count": 166179,
-  "forks_count": 15178,
-  "open_issues_count": 2726,
-  "updated_at": "2026-03-26T05:38:58Z",
+  "stars_count": 166587,
+  "forks_count": 15255,
+  "open_issues_count": 2778,
+  "updated_at": "2026-03-31T15:34:55Z",
   "created_at": "2023-06-26T19:39:32Z",
   "clone_url": "https://github.com/ollama/ollama.git",
   "ssh_url": "git@github.com:ollama/ollama.git",
   "default_branch": "main",
-  "last_build_update": "2026-03-26T02:01:29Z"
+  "last_build_update": "2026-03-31T15:11:36Z"
 }

mkdocs/docs/assets/repo-data/squidfunk-mkdocs-material.json

@@ -4,13 +4,13 @@
   "description": "Documentation that simply works",
   "html_url": "https://github.com/squidfunk/mkdocs-material",
   "language": "Python",
-  "stars_count": 26394,
-  "forks_count": 4060,
-  "open_issues_count": 2,
-  "updated_at": "2026-03-26T02:34:14Z",
+  "stars_count": 26430,
+  "forks_count": 4062,
+  "open_issues_count": 1,
+  "updated_at": "2026-03-31T14:42:16Z",
   "created_at": "2016-01-28T22:09:23Z",
   "clone_url": "https://github.com/squidfunk/mkdocs-material.git",
   "ssh_url": "git@github.com:squidfunk/mkdocs-material.git",
   "default_branch": "master",
-  "last_build_update": "2026-03-25T22:14:34Z"
+  "last_build_update": "2026-03-27T10:24:49Z"
 }

mkdocs/docs/blog/posts/2026-03-27-test-blog-post.md

@@ -0,0 +1,12 @@
+---
+date: 2026-03-27
+authors:
+  - admin
+categories:
+  - Testing
+draft: false
+---
+
+# Test Blog Post - Version 7
+
+This version uses the auto-setup token.

mkdocs/docs/blog/posts/introducing-changemaker-lite-v2.md

@@ -55,7 +55,7 @@ Read more in our [Philosophy](../../docs/phil.md) page.
 ## Get Started
 
 ```bash
-curl -fsSL https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/v2/scripts/install.sh | bash
+curl -fsSL https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/main/scripts/install.sh | bash
 ```
 
 Or follow the [Getting Started guide](../../docs/getting-started/index.md) for a walkthrough.

mkdocs/docs/docs/deployment/index.md

@@ -530,7 +530,7 @@ Pre-configured alerts in `configs/prometheus/alerts.yml`:
 
 ```bash
 # Pull latest code
-git pull origin v2
+git pull origin main
 
 # Rebuild and restart containers
 docker compose build api admin

mkdocs/docs/docs/getting-started/index.md

@@ -30,7 +30,7 @@ This guide walks you through installing Changemaker Lite, running your first dep
 The fastest way to deploy — no source code, no compilation:
 
 ```bash
-curl -fsSL https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/v2/scripts/install.sh | bash
+curl -fsSL https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/main/scripts/install.sh | bash
 ```
 
 This downloads a lightweight release package (~2 MB), runs the configuration wizard, and pulls pre-built Docker images. First startup takes ~2 minutes. See [Installation](installation.md#pre-built-image-installation) for details.
@@ -42,7 +42,6 @@ For development or customization, clone the full repository:
 ```bash
 git clone https://gitea.bnkops.com/admin/changemaker.lite
 cd changemaker.lite
-git checkout v2
 ```
 
 ```bash

mkdocs/docs/docs/getting-started/installation.md

@@ -34,7 +34,6 @@ Clone the repository:
 ```bash
 git clone https://gitea.bnkops.com/admin/changemaker.lite
 cd changemaker.lite
-git checkout v2
 ```
 
 Run the configuration wizard:
@@ -63,7 +62,7 @@ For production deployments, you can skip cloning the source repository entirely.
 ### One-Line Install
 
 ```bash
-curl -fsSL https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/v2/scripts/install.sh | bash
+curl -fsSL https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/main/scripts/install.sh | bash
 ```
 
 This script:

mkdocs/docs/docs/getting-started/upgrades.md

@@ -61,6 +61,10 @@ sudo systemctl status changemaker-upgrade.path
 2. Click the **System** tab
 3. Click **Check for Updates**
 
+The System tab shows your current version, last commit message, and auto-upgrade settings:
+
+![System tab initial state](../../assets/images/screenshots/getting-started/upgrade-01-system-tab-initial.png)
+
 The system fetches from the git remote and shows:
 
 - Current commit hash and message
@@ -68,6 +72,10 @@ The system fetches from the git remote and shows:
 - Number of commits behind
 - Changelog of incoming changes
 
+When updates are available, the panel highlights how many commits are behind and lists the incoming changes:
+
+![Update available notification](../../assets/images/screenshots/getting-started/upgrade-02-update-available.png)
+
 ### Starting an Upgrade
 
 1. Review the changelog to understand what's changing
@@ -79,8 +87,19 @@ The system fetches from the git remote and shows:
     - **Dry run** — preview what would happen without making changes
 4. Monitor the 6-phase progress indicator
 
+![Confirm System Upgrade dialog](../../assets/images/screenshots/getting-started/upgrade-03-confirm-dialog.png)
+
 The GUI polls for progress updates and displays the current phase, percentage, and status message in real time.
 
+### Upgrade Results
+
+After the upgrade completes, the System tab shows the result — including the new version, health check status, and any warnings:
+
+![Upgrade success result](../../assets/images/screenshots/getting-started/upgrade-04-success-result.png)
+
+!!! tip
+    If health checks show warnings immediately after an upgrade, wait 1-2 minutes for services to fully start before investigating.
+
 ---
 
 ## The 6 Upgrade Phases

mkdocs/docs/test-page.md

@@ -5,3 +5,9 @@ hide:
   - toc
 title: "Test Page"
 ---
+
+Testing
+
+testing testing one two
+
+hello is this content going to show? 

mkdocs/docs/test.md

@@ -0,0 +1,3 @@
+# test
+
+Hello!