phsl / new-api

- add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with
  startup validation: enabling Secure requires at least one trusted
  HTTPS entry URL
- wire common.SessionCookieSecure into the session cookie store instead
  of a hardcoded Secure=false
- print a startup warning when Secure session cookies are disabled
- document the new settings in .env.example and docker-compose files

Secure stays off by default because many deployments front new-api with
plain-HTTP reverse proxies, where a hardcoded Secure default would break
logins entirely; enabling it safely depends on the deployment's TLS
setup, so it ships as an opt-in deployment-hardening flag.

- normalize emails (trim + lowercase) and enforce uniqueness across
  registration, OAuth auto-registration, and email binding
- serialize concurrent writers on the same normalized email within a
  transaction to avoid duplicate accounts
- resolve password reset to a single matching account and reject
  ambiguous or absent matches
- require an existing password before self-service password change and
  reject login for accounts without a usable password

Merge pull request #5905 from feitianbubu/pr/e9fa595c7

Merge pull request #5892 from QuantumNous/fix/classic-web-build

- rename Makefile variables and targets from backend to api for naming consistency.
- update dev command messages and reset setup restart flow to use api terminology.

- replace the Slack OAuth icon with FaSlack from react-icons/fa to avoid the missing SiSlack export.
- add a classic Rsbuild alias for date-fns so Semi resolves its compatible date-fns v2 dependency.

Merge pull request #5886 from QuantumNous/perf/channel-test-dialog-layout

Merge pull request #5884 from QuantumNous/chore/web-default-deps

- replace per-model test text buttons with icon-only actions matching the channel list.
- let the action column shrink to its icon content to reduce table width.

- split model test status from result details so failures and latency no longer crowd one column.
- move batch progress into toast updates to keep the dialog height stable during tests.
- consolidate the channel title and model actions to reduce vertical churn.

Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7.
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.7)

---
updated-dependencies:
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

- use ai v7 usage detail fields for reasoning and cache token counts.
- keep context usage cost rendering compatible with the updated SDK types.

- bump frontend runtime and tooling packages to latest available versions, including React, Rsbuild, TanStack, VisActor, and AI SDK.
- refresh workspace catalog versions and regenerate Bun lockfile to keep default package resolution aligned.

* fix: handle ollama non-stream tool calls

* test: cover ollama non-stream tool call paths

---------

Co-authored-by: CaIon <i@caion.me>

Bumps [golang.org/x/image](https://github.com/golang/image) from 0.38.0 to 0.41.0.
- [Commits](https://github.com/golang/image/compare/v0.38.0...v0.41.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.41.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Harden user setting cache updates

* Fix user update test isolation

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.50.0 to 0.55.0.
- [Commits](https://github.com/golang/net/compare/v0.50.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: add graceful shutdown with configurable timeout

* fix: flush quota dashboard cache on graceful shutdown

Persist the in-memory CacheQuotaData aggregation to the quota_data table
before process exit, so a restart no longer drops up to one DataExportInterval
window of dashboard data (issue #5679).

AnimatedOutlet keyed its motion container by the full pathname, so
navigating between params of the same route (e.g. the dashboard tabs
under /dashboard/$section) changed the key and remounted the route
component, discarding its in-memory state. The most visible symptom:
the dashboard time range resets to the default every time you switch
sub-tabs (Model Analytics / Flow / User Analytics).

Key the transition by the matched route id instead, so param-only
navigation re-renders in place while real page-to-page navigation
still plays the enter animation. This also preserves state across the
other $section tab pages (usage logs, models, system settings).

- clone loaded application style nodes into the Shadow DOM for custom HTML rendering.
- keep HTML rendering isolated while restoring layout and typography that depend on app CSS.

- rename frontend make targets and variables to use the web terminology consistently.
- keep default and classic dev port overrides available under the updated names.

- simplify make dev-web to install default dependencies and start web/default only.
- keep dev-web-classic as the standalone classic entry and scope its install to classic.

* feat: support Wan2.7 i2v media mapping

* fix: normalize wan2.7 i2v image inputs

* fix(web): 修复自定义 HTML 样式被过滤及排版间距异常的问题

* fix(web): isolate custom HTML rendering

---------

Co-authored-by: CaIon <i@caion.me>

* feat: support safety_identifier and priority for doubao video

* feat: add 4k resolution billing tier for doubao video