// Package webapp implements the local web UI for the distributed
// monitoring worker. See docs/distributed/worker-web-app.md.
//
// Phase 1 (MVP) implements:
//
//   - Local-only auth (section 5.3): first-run password printed to
//     the worker log, bcrypt-hashed in the local SQLite store, forced
//     change on first login, session cookie with HTTP-only/Secure
//     (loopback-aware)/SameSite=Strict.
//   - Pages: overview, discovered apps (read-only), checks
//     (read-only), notifications (read-only), logs (worker log only),
//     settings (worker fields), updates.
//   - Server status: /proc and sysfs only (no SMART, no docker).
//   - Audit log with 7-day retention.
//
// Phase 2+ (OAuth, basic auth, compose management, public bind,
// docker socket, secret storage) is explicitly out of scope here.
package webapp