chore: docs, plans archive, script updates, submodule refs

.sisyphus/plans/nexusguard-config-architecture.md

@@ -72,12 +72,12 @@ Implement unified config system for non-Docker NexusGuard deployment with `/etc/
 - `apps/server-core/nexusguard-server.service` - Systemd service file
 
 ### Definition of Done
-- [ ] Server-core reads config from `/etc/nexusguard/nexusguard.conf`
-- [ ] Dashboard reads runtime config from nginx-injected `window.__CONFIG__`
-- [ ] Install script copies binaries, creates config, sets up systemd, configures nginx
-- [ ] Uninstall script stops service, removes files, reloads nginx
-- [ ] All unit tests pass
-- [ ] Tested on real server (172.20.8.191)
+- [x] Server-core reads config from `/etc/nexusguard/nexusguard.conf`
+- [x] Dashboard reads runtime config from nginx-injected `window.__CONFIG__`
+- [x] Install script copies binaries, creates config, sets up systemd, configures nginx
+- [x] Uninstall script stops service, removes files, reloads nginx
+- [x] All unit tests pass
+- [x] Tested on real server (172.20.8.191)
 
 ### Must Have
 - Config file loading with fallback to env vars
@@ -199,15 +199,15 @@ Wave FINAL (After ALL tasks):
   - `apps/device-agent/scripts/install_agent.sh` - Shell script pattern to follow
 
   **Acceptance Criteria**:
-  - [ ] File created: `apps/server-core/internal/config/config_loader.go`
-  - [ ] Function `LoadConfFile(path string) error` exists
-  - [ ] Parses `export KEY=VALUE` format
-  - [ ] Skips comments (#) and empty lines
-  - [ ] Handles Windows line endings (\r\n)
-  - [ ] Trims whitespace around keys and values
-  - [ ] Calls `os.Setenv()` for each valid key
-  - [ ] Returns error for missing file (non-fatal)
-  - [ ] Supports `NEXUSGUARD_CONF` env var override
+  - [x] File created: `apps/server-core/internal/config/config_loader.go`
+  - [x] Function `LoadConfFile(path string) error` exists
+  - [x] Parses `export KEY=VALUE` format
+  - [x] Skips comments (#) and empty lines
+  - [x] Handles Windows line endings (\r\n)
+  - [x] Trims whitespace around keys and values
+  - [x] Calls `os.Setenv()` for each valid key
+  - [x] Returns error for missing file (non-fatal)
+  - [x] Supports `NEXUSGUARD_CONF` env var override
 
   **QA Scenarios**:
 
@@ -293,10 +293,10 @@ Wave FINAL (After ALL tasks):
   - `apps/dashboard-ui/nginx.conf` - Current nginx config
 
   **Acceptance Criteria**:
-  - [ ] File modified: `apps/dashboard-ui/src/services/api.ts`
-  - [ ] `window.__CONFIG__` type declared
-  - [ ] Runtime config read with fallback to VITE_API_BASE_URL
-  - [ ] TypeScript compiles without errors
+  - [x] File modified: `apps/dashboard-ui/src/services/api.ts`
+  - [x] `window.__CONFIG__` type declared
+  - [x] Runtime config read with fallback to VITE_API_BASE_URL
+  - [x] TypeScript compiles without errors
 
   **QA Scenarios**:
 
@@ -359,11 +359,11 @@ Wave FINAL (After ALL tasks):
   - `apps/server-core/main.go:356` - API port default (8080)
 
   **Acceptance Criteria**:
-  - [ ] File created: `apps/dashboard-ui/nginx.conf.template`
-  - [ ] `envsubst` placeholders for `${API_PORT}`, `${API_BASE_URL}`
-  - [ ] `window.__CONFIG__` injection via `sub_filter` or template
-  - [ ] SPA fallback configured
-  - [ ] `nginx -t` validates syntax
+  - [x] File created: `apps/dashboard-ui/nginx.conf.template`
+  - [x] `envsubst` placeholders for `${API_PORT}`, `${API_BASE_URL}`
+  - [x] `window.__CONFIG__` injection via `sub_filter` or template
+  - [x] SPA fallback configured
+  - [x] `nginx -t` validates syntax
 
   **QA Scenarios**:
 
@@ -434,13 +434,13 @@ Wave FINAL (After ALL tasks):
   - `apps/dashboard-ui/nginx.conf.template` - Nginx config to copy
 
   **Acceptance Criteria**:
-  - [ ] File created: `nexusguard-install.sh`
-  - [ ] `--help` flag shows usage
-  - [ ] Creates `/etc/nexusguard/nexusguard.conf` with chmod 600
-  - [ ] Creates systemd service file
-  - [ ] Creates nginx config
-  - [ ] Enables and starts service
-  - [ ] Idempotent (safe to run twice)
+  - [x] File created: `nexusguard-install.sh`
+  - [x] `--help` flag shows usage
+  - [x] Creates `/etc/nexusguard/nexusguard.conf` with chmod 600
+  - [x] Creates systemd service file
+  - [x] Creates nginx config
+  - [x] Enables and starts service
+  - [x] Idempotent (safe to run twice)
 
   **QA Scenarios**:
 
@@ -530,11 +530,11 @@ Wave FINAL (After ALL tasks):
   - `nexusguard-install.sh` - Install script to reverse
 
   **Acceptance Criteria**:
-  - [ ] File created: `nexusguard-uninstall.sh`
-  - [ ] Stops and disables service
-  - [ ] Removes all installed files
-  - [ ] Reloads nginx and systemd
-  - [ ] Preserves database and WireGuard state
+  - [x] File created: `nexusguard-uninstall.sh`
+  - [x] Stops and disables service
+  - [x] Removes all installed files
+  - [x] Reloads nginx and systemd
+  - [x] Preserves database and WireGuard state
 
   **QA Scenarios**:
 
@@ -598,11 +598,11 @@ Wave FINAL (After ALL tasks):
   - `apps/device-agent/scripts/sys-bridge.service` - Systemd template
 
   **Acceptance Criteria**:
-  - [ ] File created: `apps/server-core/nexusguard-server.service`
-  - [ ] `EnvironmentFile=/etc/nexusguard/nexusguard.conf`
-  - [ ] `Restart=always` and `RestartSec=5`
-  - [ ] Runs as root
-  - [ ] `After=network.target postgresql.service redis.service`
+  - [x] File created: `apps/server-core/nexusguard-server.service`
+  - [x] `EnvironmentFile=/etc/nexusguard/nexusguard.conf`
+  - [x] `Restart=always` and `RestartSec=5`
+  - [x] Runs as root
+  - [x] `After=network.target postgresql.service redis.service`
 
   **QA Scenarios**:
 
@@ -683,7 +683,7 @@ ssh root@172.20.8.191 "curl -s http://localhost/"  # Expected: HTML with window.
 ```
 
 ### Final Checklist
-- [ ] All "Must Have" present
-- [ ] All "Must NOT Have" absent
-- [ ] All tests pass
-- [ ] Tested on real server (172.20.8.191)
+- [x] All "Must Have" present
+- [x] All "Must NOT Have" absent
+- [x] All tests pass
+- [x] Tested on real server (172.20.8.191)