Merge branch 'main' of git.stroblme.de:Fluksio/app

NOTEPAD.md

@@ -22,6 +22,13 @@ Deferring because out of scope is fine, but don't mention deferring than.
   pixels than eighty and a third chart may now fit — worth measuring against the
   panel before adding one. The temperature history was the one dropped;
   `history.climate_*` still answers, so it is a tile away.
+- BUG/INFRA: `compose.yml` builds the frontend with `VITE_API_URL=https://api.${DOMAIN}`
+  and only `compose.local.yml` overrides it to `http`. Any `up --build` that does not layer
+  the local file therefore ships a bundle calling `https://api.localhost`, which fails with
+  `ERR_CERT_AUTHORITY_INVALID` and breaks login entirely — nothing terminates TLS locally.
+  It recurs every time the stack is brought up without the override, so it is not a stale
+  image but a default that is wrong for the local target. Either flip the default or make the
+  local target the one the Makefile always passes.
 - FEAT/UI: a bar's nested reading is captioned by its port name, which is
   chosen for the graph rather than for somebody reading it across a room.
   `Segment` now takes an optional `label`; the house dashboard sets one
@@ -55,6 +62,15 @@ Deferring because out of scope is fine, but don't mention deferring than.
   zero rather than as unknown — which is how a deleted `failures_24h` showed as "0 failures"
   unnoticed. The per-card half is one line; Home sums across installations and has nowhere to
   say "3 of 4 reporting", so the two want doing together.
+- PERF/API: enabling or disabling one flow calls `FlowController.reload()`, which tears down
+  and rebuilds *every* flow — reconnecting each node, including the ones that talk to hardware
+  over the network. On the tinyhouse installation (nineteen flows, MQTT + UniFi + aircon) a
+  single toggle takes 8-10s end to end. Same root as the seeding cost below: there is no way
+  to change one flow's runtime state without rebuilding the whole pipeline.
+- CHORE/TEST: `runtime.spec.ts` "the home page lists flows and can stop one" asserts the row
+  reads "Stopped" within Playwright's 5s default. That is shorter than a real installation's
+  rebuild (above), so the spec passes on a small instance and fails on a populated one. It is
+  the rebuild that wants fixing, not the timeout — raising it would only hide the cost.
 - FEAT/SEC: `locked` is a read-only surface, not a permission — the server accepts a publish
   from a panel whose dashboard says locked. Making it real means carrying the flag into
   `_panel_may`.