[jakthom]

Configuration writes rejected valid duration strings, the default admin listener exposed unauthenticated controls to the network, and several form paths failed silently or lost their dialog behavior. This change addresses the 13 review findings and adds regression coverage for the affected boundaries.

• Default administration to loopback, document SSH access, protect REST/UI mutations against foreign browser origins, and reject SSE/WebSocket redirects before credentials can follow them.
• Align duration schemas with JSON and document configuration types, conditional requirements, limits, and default semantics in OpenAPI. Test duration writes and configuration export/import round-trips.
• Give every configuration control an accessible name. Keep type-change credentials in POST bodies, restrict SQL-preview query parameters, and redact endpoint credentials in read-only views.
• Keep validation inside the active dialog, preserve Close/Cancel after swaps, dispose editor listeners on dismissal, and show accessible save/network/timeout and stale-poll feedback.
• Support native create/edit/validation and type selection without JavaScript. Direct edit pages return to their saved overview with JavaScript too; remove the obsolete table-swap path.
• Preserve the utilitarian layout, compact form spacing, and existing design tokens. Fix the documented just secure entry point.

Migration: the admin default changes from 0.0.0.0:2112 to 127.0.0.1:2112. Direct remote access now requires an explicit protected binding. README and onboard docs include SSH tunneling and the bridge-network Docker invocation. Upstream stream URLs must point to their final endpoint; redirects are rejected.

Validation:

• Full Go race suite: passed; 79.5% aggregate statement coverage.
• 19 Playwright tests: passed, including desktop/mobile, all transport control names, native forms, failed requests, and bounded listener cleanup.
• go vet, golangci-lint, native build, and Linux/arm64 build with CGO disabled: passed.
• just secure and Linux/arm64 govulncheck: no reachable known vulnerabilities; gosec reports zero issues. npm audit: zero vulnerabilities.
• Desktop/mobile visual inspection and Impeccable detector: passed; no remaining detector findings.

The vulnerability database still lists eight advisories in required modules whose affected packages are not imported. Physical CAN/USB hardware, live PostgreSQL/TimescaleDB integration, and other browser engines were not exercised. The audit and remediation record preserves the evidence and scope.