* **docker:** derive nginx resolver from container DNS ([66b299a](https://github.com/offendingcommit/openconcho/commit/66b299a28e912bc2f8c2922b40292696c4f7d81a))
* **docker:** drop dead HONCHO_UPSTREAM and same-origin default ([a2854ab](https://github.com/offendingcommit/openconcho/commit/a2854ab8ea0a9eec2a06838fb394a0264f7dd80d))
* **web:** enforce upstream allowlist in vite dev proxy ([b4fac95](https://github.com/offendingcommit/openconcho/commit/b4fac95f37da3985dbc4fbf64d04dd509ec86c2c))
* **web:** raise connection-test timeout for cold upstreams ([409d7d8](https://github.com/offendingcommit/openconcho/commit/409d7d8be7f5cc94421dce32a54105ea48bfd44b))
* **web:** strip content-encoding from vite dev proxy responses ([6b602c0](https://github.com/offendingcommit/openconcho/commit/6b602c05bb81721dfc102b3f97112b2cf58d4d60))
### Features
* **docker:** header-driven /api reverse proxy in nginx ([753c978](https://github.com/offendingcommit/openconcho/commit/753c978f56dab61d0c15b25b56ecf438cdc5ae88))
* **docker:** render SSRF allowlist map from env ([0af1ad9](https://github.com/offendingcommit/openconcho/commit/0af1ad923cd2aa61a201d65ce4f19acb13858790))
* **docker:** split compose into dev-forward build and prod pull ([c9bd2db](https://github.com/offendingcommit/openconcho/commit/c9bd2db07d84e0eedffeadcc6f2bc15c628eb251))
* **web:** add dispatchFor transport helper for same-origin proxy ([9945e4c](https://github.com/offendingcommit/openconcho/commit/9945e4cf148aec6fc47bb853e8661c339c52ff32))
* **web:** dev /api proxy middleware mirroring nginx ([ab8a1ba](https://github.com/offendingcommit/openconcho/commit/ab8a1ba866728ff972544c1d912fed59ba03a4a7))
* **web:** route checkConnection and discovery through the proxy ([9893230](https://github.com/offendingcommit/openconcho/commit/9893230cde3d11ce73350bd12fffae236ee9adff))
* **web:** route web build through same-origin /api proxy ([0935099](https://github.com/offendingcommit/openconcho/commit/0935099bc28468a21183f5f03105645f4ac8aa8a))
* **docker:** full self-hosted Compose support ([282ba1b](https://github.com/offendingcommit/openconcho/commit/282ba1b76c43b51aae5bf4d173fd2c76bfbd8eac))
* **web:** add Fleet dashboard view for cross-instance observability ([12712bb](https://github.com/offendingcommit/openconcho/commit/12712bb0b087f3413173328cad96c9b04bb35ca5))
* **web:** configurable peer display name ([3de6832](https://github.com/offendingcommit/openconcho/commit/3de6832a5dc7aad971ac87e356674d834fe9e715))
* **ci:** trigger release build on release publish, not tag push ([52a7f09](https://github.com/offendingcommit/openconcho/commit/52a7f09ce6c3202d4929e1d6282d1d6b12578b40))
* harden token and URL handling ([5cfbae6](https://github.com/offendingcommit/openconcho/commit/5cfbae62489c9ec4cc85f30a370b45db269defbc))
### Features
* **docker:** add containerized web build with CORS guidance ([cfe07f1](https://github.com/offendingcommit/openconcho/commit/cfe07f190002c0a6bc9a4433d9cb352147e10c7e))
* add health indicator and localhost auto-detect ([38e76d3](https://github.com/offendingcommit/openconcho/commit/38e76d33dea7fb5b31547ff77f5099600894176e))
* improve dark mode accessibility contrast ([7827438](https://github.com/offendingcommit/openconcho/commit/7827438d9203038c0f2396a3675b6a159229c584))
* show structured page placeholders while loading ([3075e4a](https://github.com/offendingcommit/openconcho/commit/3075e4a005af58e484b0c07074b9423c734946f9))
* deep linking for hosted URLs and openconcho:// scheme ([578c8f4](https://github.com/offendingcommit/openconcho/commit/578c8f4c46f470f450414332ee2290edf2ecd344))
* **release:** regenerate and commit Cargo.lock on release ([6f9abf8](https://github.com/offendingcommit/openconcho/commit/6f9abf84ff32069c917b8613068b982bc9d28cf1))
* **web:** render sidebar on settings route ([557fecf](https://github.com/offendingcommit/openconcho/commit/557fecf03807b207539e6b50f32b3eec0cfe7191))
* **web:** show settings on first load and hoist DemoProvider globally ([8f5a6aa](https://github.com/offendingcommit/openconcho/commit/8f5a6aa7e9118e182d5959f902f07dafe2026f30))
* **ci:** make sure we build web before we build the app ([c3b4e58](https://github.com/offendingcommit/openconcho/commit/c3b4e58816f48420ca4970ba1989316690c60391))
* **release:** sync versions to v0.4.0 and wire up semantic-release npm plugin ([18feaeb](https://github.com/offendingcommit/openconcho/commit/18feaeb3d4f9749b7ca33b26c1912ac99a6e2fb9))
* **release:** use tauri-action beforeBuildCommand for web build ([c66d0f3](https://github.com/offendingcommit/openconcho/commit/c66d0f326ce4209f7298402c20bfcb226616012c))
### Features
* **demo:** extend mask() to all breadcrumbs, page titles, and identifiers ([123828c](https://github.com/offendingcommit/openconcho/commit/123828ccb6e6b14300e73229f70127ac0b1d69bb))
* **demo:** replace blur with asterisk masking of user data via React context ([8f9d806](https://github.com/offendingcommit/openconcho/commit/8f9d806eef3a6d77c3c7b017f8ff23c1177a649b))
* **web:** show app version in sidebar footer via Vite define ([7848d69](https://github.com/offendingcommit/openconcho/commit/7848d69524f739c3139d0c1fdb99c686fc6fdfb5))
* **demo:** replace redacted font with CSS blur on main content ([7c022d0](https://github.com/offendingcommit/openconcho/commit/7c022d0929d536e113da82cdd164edc6c1b61b1c))
### Features
* add demo mode feature flag using Redacted Script font ([c2e2c83](https://github.com/offendingcommit/openconcho/commit/c2e2c835de7e6faa64e480f57ba1df08addb2577))
* rename Honcho UI to OpenConcho, use SVG logo in sidebar and settings ([d0aba02](https://github.com/offendingcommit/openconcho/commit/d0aba0250d727ac0c696b7af17436504024c760d))
* **ci:** add workflow_dispatch to release for manual tag builds ([18905ef](https://github.com/offendingcommit/openconcho/commit/18905ef98740517c0ba87e34495a6bb869af1d34))
* **ci:** use RELEASE_TOKEN PAT so tag push triggers release workflow ([20bec5c](https://github.com/offendingcommit/openconcho/commit/20bec5c89976416e3bf766f50f6f1a852973e76f))
* center settings page in full viewport ([88565ea](https://github.com/offendingcommit/openconcho/commit/88565eaf1a90f9febaec04ffb48265d7b9f3dfd5)), closes [#root](https://github.com/offendingcommit/openconcho/issues/root)
* **ci:** fold semantic-release into CI as post-check release job ([bfbc8c1](https://github.com/offendingcommit/openconcho/commit/bfbc8c11480ba80c941ed50a984ec98e6050b7dc))
* **ci:** use GITHUB_TOKEN instead of missing GH_TOKEN secret ([e446efe](https://github.com/offendingcommit/openconcho/commit/e446efea04ed8ef9eae9170aa287aa6863c87bed))
* invert icon to white logo on indigo background ([a519745](https://github.com/offendingcommit/openconcho/commit/a519745f201fc80f9b5ec5ae21b6e77e4b6a2156))
* regenerate Tauri icons with correct indigo background ([1f118d9](https://github.com/offendingcommit/openconcho/commit/1f118d914f87459ff5b5513ca36216de7b56ebb0))
* **release:** wire tauri-action to existing semantic-release GitHub release ([57f89bc](https://github.com/offendingcommit/openconcho/commit/57f89bc0cb54f2a8f8b3632e888a3786298abd17))
* **web:** use esnext build target instead of safari13 ([8052a7d](https://github.com/offendingcommit/openconcho/commit/8052a7d27a6bf0d533feeb62536524d18fab4b58))
### Features
* apply brand colors to logo (indigo favicon, dark-bg Tauri icons) ([35e6c5d](https://github.com/offendingcommit/openconcho/commit/35e6c5df4d317dd66b1df09d0ba330b530fbd460))
* **ci:** multi-platform release matrix for macOS/Linux/Windows ([7379c35](https://github.com/offendingcommit/openconcho/commit/7379c35a6bb15367643ba27db3a3302331c5a122))
* full shadcn/ui component system with consistent typography ([9a74182](https://github.com/offendingcommit/openconcho/commit/9a74182f97add5034b432e7f753048c6b223290d))
* restructure as pnpm monorepo with Tauri desktop shell ([92c4dfd](https://github.com/offendingcommit/openconcho/commit/92c4dfd3dd032f7b9662b81007ccfacc20375d18))
* set OpenConcho logo as app icon for web and Tauri ([a07f5ab](https://github.com/offendingcommit/openconcho/commit/a07f5abfc5dafa3cb81f103a6b467c6f63cb3381))
* wire all remaining API endpoints ([45e0183](https://github.com/offendingcommit/openconcho/commit/45e01834398859d2eadcca1abe1eb213e3ff629d))