Backend:
- Password-protected dashboard with signed session cookies (auth.service,
  auth.routes) and a startup refusal to bind a non-loopback HOST without
  DASHBOARD_PASSWORD.
- Centralised env configuration (config.service) covering network, paths,
  retention and serving mode; documented in backend/.env.example.
- Retention sweep for runs and orphaned artifact directories, plus a
  manual cleanup endpoint.
- Diagnostics routes and a version module.
- Test-runner cancellation, richer execution events and socket handling.
- Vitest suite covering api, auth, cancellation, config, hardening,
  rate limiting, session restart and bundle-secret leakage.

Frontend:
- AuthGate, LoginScreen and auth.service for the session flow.
- ErrorBoundary around the app shell.
- result-format extracted from result-primitives; run history, timeline,
  comparison and result views updated to match the new event payloads.
- frontend/.env.example documenting the client-visi...