* fix: make archived log shard connections concurrency-safe and recoverable
* fix: build the WebSocket online table before its consumers start
* perf: cap stored payloads, index log lookups by IP and rule, batch IP tag writes
* fix: keep archived log shards readable when the live table gains a column
* feat: merge IP tag history when their database location changes
* refactor: move request payloads out of the access log into their own table
* feat: scope log database export to a time range and selected tiers
* feat: add an IP watchlist that full-captures watched IPs
* feat: split log storage into security events, access rows, and payload tiers
* feat: roll up requests per actor and path into daily analysis tables
* fix:actor key by ip
* feat: add a source and path analysis page over the daily rollups
* feat: exclude chosen source IPs from web log recording
* docs: add upgrade notes for the analysis page and log IP exclusion
* feat: derive the log partition from the time range and look up identifiers across all of them
* feat: add time partition verbs and the period naming they share
* feat: cut log archives per month and expire them by dropping partitions
* feat: manage log partitions, and answer why an IP has no logs
* fix: read archived SQLite log shards read-only and choose tiers by data
* fix: count the live log shard from access_log instead of a stale snapshot
* fix:export db bug
* fix: default backend keep-alive pool (512/128/90s) to stop connect-close churn under load
* chore: gen_swagger.bat outputs json only, syncs doc site, runs route test
* feat: pin web frontend version and embed it into the binary
- Migrate MD5+global-salt hashing to bcrypt with transparent upgrade on login
- Enforce password change in Auth middleware (allow only changepwd/logout/ws)
- Generate random initial admin password on fresh install (data/initial_password.txt)
samwaf