monorepo finale: relocate crates, monitor release pipeline, docs overhaul

[lollipopkit]

Summary

This PR finishes the monorepo migration with three main blocks, plus follow-up hardening:

1. migrate: merge rust/ and rust_builder/ into crates/sbm_ffi

• The cargokit plugin shell and the sbm_ffi crate now share one directory (cargokit's official example layout), keeping the top level clean
• Workspace members, FRB rust_root, pubspec paths, and per-platform glue updated in sync
• Verified: cargo test --workspace green, 12/12 FFI parity tests pass, flutter build macos --debug builds through cargokit for real

2. feat: monitor release pipeline

• Manual trigger only; version comes from the monitor crate (monitor-v* tags), decoupled from the app's v1.0.x
• Native binaries: Linux musl (amd64/arm64, native arm runners) / macOS (both archs) / Windows → GitHub Release + SHA256SUMS
• Docker: the Linux musl binary is reused in an Alpine image pushed to ghcr.io — zero in-image compilation, no QEMU
• Drive-by fixes: Dockerfile frontend path mismatch with server.rs, build/runtime glibc mismatch, reqwest switched to rustls to drop the OpenSSL dependency (prerequisite for static musl builds)
• install.sh rewritten for the new release layout; fresh installs generate a random JWT_SECRET
• Verified: local image build + run smoke test (health 200, frontend OK, uptime collection OK), 41 monitor tests green

3. docs: full audit of the docs site (en/zh/ja/de/fr/es)

• Removed content confirmed fabricated after checking against the code: system tray, Touch Bar, multi-window, NUL keep-alive, SFTP paging/TTL cache, nonexistent keyboard settings, etc.
• Fixed factual errors: home tab list, Windows integration language, encrypted-storage description, class/setting names, nonexistent test file examples
• Added monorepo layout, Rust testing, and FRB codegen docs; README monitor links point into the monorepo
• Added dependabot config (cargo × 3 directories + monitor frontend npm + GitHub Actions)
• Removed doc/adr (intentional) and cleaned up all references
• Verified: docs site builds, 139 pages

4. Follow-ups on this branch

• Monitor dependencies upgraded across major versions (backend: ntex 3, sqlx 0.9, jsonwebtoken 10, reqwest 0.13, etc.; frontend: react 19, vite 8, vitest 4, tailwind 4, eslint 10) — also resolves the vitest critical CVE (GHSA-5xrq-8626-4rwp) flagged by Socket
• All 6 inline review findings fixed (full-volume drop on Windows, missing Windows net counters, hard-coded velocity key, unbounded retention tables, dead serve CLI flags + TLS wiring, since-boot CPU average)
• Security hardening: no baked-in admin/admin123, no default JWT secret — both generated randomly on first start

Notes

• After the first monitor-release workflow run, set the server-box-monitor ghcr image to public in package settings if desired
• The cargokit path changes for iOS/Android/Linux/Windows mirror macOS but are unverified on-device; watch the first five-platform CI build

Summary

Changes

• sbm_parser: Linux/BSD/Windows status parsing (core parsers): New Rust crate implementing pure-function parsers for CPU, memory, swap, disk (lsblk + df fallback), network, temperature, connections, disk IO, batteries, sensors, GPU (NVIDIA XML, AMD JSON), and SMART health — replacing the Dart parsing layer as the single source of truth. Parsers emit raw counters; diff/windowing helpers are provided as pure functions with no mutable state.
• sbm_parser: Script generation and output parsing (shared wire format): New Rust script generation module that is a literal port of the Dart script builders: Unix sh and Windows PowerShell scripts with status/process/shutdown/reboot/suspend functions, custom command injection, disabled-command filtering, install/exec command generation (including Windows -EncodedCommand base64 wrapping), and output segment splitting.
• sbm_ffi: flutter_rust_bridge FFI layer (Rust side): New FFI binding crate exposing sbm_parser functions to Dart via flutter_rust_bridge 2.12.0: parse_status_json (async), parse_windows_net_speed_json (sync), command_specs (sync), separator (sync), build_script, install_command, exec_command, shell_func_flag, parse_script_output (async). System string parsing, error handling, and JSON serialization at the boundary.
• Dart FFI integration: app-side script generation and status parsing migration: Dart app migrated from Dart-based parsing and script generation to FFI calls into sbm_ffi. shell_func.dart now delegates to ffi.buildScript/installCommand/execCommand/shellFuncFlag. server_status_update_req.dart calls ffi.parseStatusJson and assembles JSON into existing model classes. single.dart calls ffi.parseScriptOutput for output splitting. Dart script_builders.dart and windows_parser.dart deleted.
• Dart test migration: deleted tests and FFI parity tests: Dart unit tests for parsing (amd_smi, btrfs, conn, cpu, memory, uptime, script_builder, disabled_cmd_types) deleted — behavior now locked by Rust dart_compat.rs and script_compat.rs. New frb_parser_test.dart verifies FFI binding loading and JSON contract. rust_lib_helper.dart loads the native dylib in tests.
• Monitor: Authentication and JWT security: New authentication system for the monitor web service: JWT token generation/verification (HS256, 24h expiry), bcrypt password hashing, bearer token middleware, initial admin bootstrap with random password, JWT secret auto-generation with validation against known defaults and minimum length.
• Monitor: Web server, API routes, and CORS: ntex web server with TLS (rustls/ring), CORS allowlist middleware, static file serving (SPA fallback), API routes (/login, /status, /metrics, /metrics/history, /velocity, /velocity/history, /health), and legacy Go-compatible /status endpoint.
• Monitor: Configuration loading, Go-compat normalization, and env overrides: Config struct supports both Rust-native and Go-compatible fields, with automatic normalization from Go format. TOML/JSON file loading, environment variable overrides, CLI arg overrides (--addr/--cert/--key), JWT secret resolution, push rate parsing.
• Monitor: Database schema, migrations, and data cleanup: Three SQL migrations creating system_metrics, alerts, users, velocity_metrics, cpu_core_metrics, network_totals, config management tables, component_metrics, rule_executions, performance_metrics, and retention_policies. Data cleanup service with time-based retention, DB size cap enforcement, and VACUUM scheduling.
• Monitor: Monitoring loop, metrics collection, and status adaptation: Monitoring loop generates a core-only status script via sbm_parser, writes/executes it locally each cycle, parses output, and adapts ServerStatus into SystemMetrics. CPU delta logic differs per platform (Linux cumulative ticks vs BSD/Windows one-shot percentages). Disk aggregation with APFS volume pooling. Metrics stored in SQLite.
• Monitor: Velocity/time-series processing and rules engine: Velocity tracking via NetworkTimeSeries and CpuTimeSeries (two-sample delta), VelocityProcessor/VelocityManager with per-server state and DB persistence. Rules engine checks CPU/memory/swap/disk/network/temperature thresholds with Go-compatible threshold parsing, triggers push notifications with rate limiting.
• Monitor: Push notification channels: Push notification implementations for webhook (configurable method/headers/body template), ServerChan (SCT API), Bark (iOS push), and iOS (push.lolli.tech). Template variable replacement ({{message}}, {{name}}). URL encoding for Bark. Rate limiting via global PushRateLimiter.
• Monitor: Docker, install script, and CI/CD release pipeline: Two Dockerfiles (local build with Alpine/musl, CI with prebuilt musl binaries), docker-compose.yaml, systemd install script, and GitHub Actions monitor-release.yml workflow for multi-platform native binaries + Docker image publishing to ghcr.io.
• Monitor: Frontend (Svelte) and webui package: New Svelte frontend for the monitor: login page, dashboard, detail panel, charts, theme/locale toggles, API client with JWT bearer auth and 401 auto-logout. New packages/webui shared Svelte component library (Badge, Button, Card, IconButton, Input, Select, Spinner) with theme CSS.
• Monitor: SSH e2e test and integration tests: Opt-in SSH e2e test for sbm_parser (upload script → exec → parse → compare with direct commands) for both Unix and Windows remotes. Monitor integration tests for config loading, database init, JWT auth, and password hashing.
• Rust workspace and dependency vulnerabilities: New Rust workspace (Cargo.toml) with three members: sbm_parser, sbm_ffi, monitor. Verified dependency vulnerabilities: rsa@0.9.10 (RUSTSEC-2023-0071, Marvin Attack timing sidechannel) and rustls-pemfile@2.2.0 (RUSTSEC-2025-0134, unmaintained).
• App platform integration: iOS/Android/macOS/Linux/Windows build config: Platform-specific build configuration for the FFI plugin: iOS/macOS Podspecs, Android build.gradle, Linux/Windows CMakeLists, cargokit build tool integration. iOS Podfile added, xcconfig modified. Generated plugin glue files for all platforms.
• Documentation updates: CLAUDE.md, README, and docs updated to describe the new monorepo layout, Rust workspace, FFI architecture, shared parser design, monitor service, and testing instructions. Multi-language docs (en/zh/de/es/fr/ja) updated.

[GT-610]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[GT-610]

@winnowl review

[lollipopkit]

@coderabbitai ignore

[coderabbitai]

✅ Action performed

Reviews paused.