Promotion of staging to main

[kaissb]

Summary

Prepare Oberwatch for the v0.1.0 stable release. This PR promotes all work from staging into main, bringing the proxy from a single-provider OpenAI forwarder to a fully multi-provider routing layer with SQLite persistence, budget enforcement, live alerting, a polished dashboard, installer scripts, and hardened CI/CD — all passing the full quality gate checklist.

136 files changed, 6 668 insertions, 474 deletions across 25 commits.

Changes

Multi-Provider Proxy Routing

• Route OpenAI-compatible /v1/chat/completions requests by model to the correct upstream (OpenAI, Anthropic, Google Gemini, Ollama) instead of assuming OpenAI
• Add Anthropic OpenAI-compat translation layer and Gemini support for OpenAI SDK-style requests
• Route native Ollama /api/* requests to the Ollama upstream; reject unresolved models instead of silent fallback
• Normalize Anthropic snapshot model IDs (e.g. claude-haiku-4-5-20251001) to pricing families for accurate costing

SQLite Persistence & Budget Enforcement

• Persist agents, budget state, and emergency stop as a global flag in SQLite
• Isolate budget kills to proxy traffic only — dashboard and management APIs remain available when an agent is disabled
• Track disable reasons per agent; auto-clear budget-exceeded kills on period reset while keeping manual/runaway kills persistent
• Remove implicit agent seeding — configured gate agents no longer materialize until they receive real traffic
• Persist budget threshold alerts to SQLite with structured metadata (threshold, spend, limit, action, period start)

Dashboard & UX

• Add live toast notifications for budget threshold events with agent name and crossed percentage
• Add agent editing panel and emergency stop resume UI
• Redesign login/setup with centered brand-above-card layout, white logo, and Enter-to-submit on all forms
• Replace empty-state placeholder with terminal-style proxy usage guidance
• Show plain semantic version in health endpoint and sidebar (no channel suffix)
• Embed built Svelte assets and static files (logos) in all Go-serving paths with local build fallback

Installer & Production Deployment

• Add Linux/macOS install.sh and uninstall.sh scripts with systemd service wiring and default config generation
• Add docs/production.md covering TLS, reverse proxies, firewall rules, persistence, backups, upgrades, and health monitoring
• Redesign README as a polished OSS landing page with light/dark mode logo support and updated quick-start guidance

CI/CD & Security Hardening

• Pin all 3rd party GitHub Actions to commit SHA hashes (supply chain security)
• Run Dockerfile as non-root oberwatch user with dedicated group and owned /data volume
• Upgrade golang.org/x/crypto v0.44.0 → v0.45.0 (CVE-2025-58181, CVE-2025-47914)
• Gate Docker image builds behind a ci-gate job — no image push unless lint, test, vet, and dashboard build all pass
• Separate registry channels: staging tag for staging branch, beta for main, latest reserved for tagged releases
• Allow container startup without a mounted oberwatch.toml (config-free with built-in defaults + env overrides)

Test Coverage & Quality Gate

• Add budget manager tests covering RenameAgent, cloneState, persistedDisableReason, persistedStatusForState, firstNonZeroTime, triggeredAlerts, toBudgetView, loadPersistedAgents, flushAgentIfNeeded — budget package coverage 84.5% → 92.5%
• Add SQLite agent, emergency stop, CLI helper, and proxy helper coverage
• Add proxy tests for provider resolution, compatibility translation, and routing errors
• Overall coverage 82.4% (≥80%), pricing 97.9% (≥90%), budget 92.5% (≥90%)
• .gitignore updated with *.key, coverage.out, node_modules/, .oberwatch/

---

Testing

• Added/updated tests (budget, proxy, storage, CLI, dashboard handler coverage)
• All tests pass (go test -race ./... — 0 failures)
• Linting passes (golangci-lint run — 0 issues)
• go vet ./... clean
• Dashboard builds and type-checks (npm run build && npm run check — 0 errors)
• Binary builds (go build -o bin/oberwatch ./cmd/oberwatch)
• Smoke tested: health endpoint status:ok, dashboard HTTP 200, auth flow setup_complete:false on fresh DB

---

Checklist

• PR title follows Conventional Commits format (chore: promote staging to main for v0.1.0)
• No new dependencies added (golang.org/x/crypto upgraded only — security patch)
• No sensitive data in code or logs
• No hardcoded localhost in non-config Go code
• No leftover fmt.Println/log.Println — all structured slog
• No mock/seed/demo data in dashboard (only documentation curl examples)
• All required files present and non-empty (LICENSE, README, CONTRIBUTING, SECURITY, CHANGELOG, CI workflows, scripts, docs)
• Aikido SAST findings resolved (non-root Docker, pinned Actions, crypto CVEs)