Added
- Hardened dashboard authentication. Failed logins are now rate-limited per client IP with exponential backoff and a global cap (HTTP 429 on lockout), so the login can't be brute-forced. The dashboard password can be supplied pre-hashed via
H2G_PASSWORD_HASH(argon2, generated withhevy2garmin hash-password) so the plaintext never sits in the environment; session cookies gain theSecureflag over HTTPS and are signed with an optional dedicatedH2G_SECRET(session lifetime configurable viaH2G_SESSION_TTL_DAYS, default 30 days); a "Sign out everywhere" action invalidates every active session; and standard security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, a baseline CSP) are sent on every response. Existing password-only deployments keep working unchanged.