Dependency cleanup (ponytail audit):
- Drop 14 unused dependency declarations across 7 crates; quick-xml and
x509-parser leave the tree entirely (SAML cert/XML work is handled by
bergshamra + roxmltree).
Fixes:
- introspect: drop the over-broad "microsoft" UTF-16 bulk-scan marker that
mislabeled Secure-Boot-signed non-Windows bootables (memtest86, signed
BSDs, firmware tools) as Windows — the string lives in their MS-signed
EFI loader's FAT long-filename entries. INTROSPECT_REV 3 -> 4 re-probes
existing local ISOs on startup so the bogus label clears on upgrade.
- upload: begin_upload now reclaims an abandoned <id>.partial instead of
rejecting the re-upload with "already uploading". Robust against browser
refresh, tab close, and dropped connections (the chunked protocol can't
resume a dead session anyway).
Features:
- Storage upload: multi-file + concurrent. Each dropped/selected .iso gets
its own progress row and uploads independently; a single page-leave guard
plus a pagehide keepalive-abort replace the old shared singletons.
- Operator API key (x-api-key): a persisted key authenticates /api/* exactly
like an operator session, for Postman/scripts. New core ApiKeyStore
(generated on first run, regenerable), accepted in require_auth alongside
the session cookie, surfaced in Settings -> Advanced with copy + regenerate
and a usage reference. GET /api/api-key + POST /api/api-key/regenerate.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
