A big infrastructure day. CKFinder removed entirely — 695 vendored files deleted. Replaced with a purpose-built file manager: three JSON endpoints (list, upload, delete), thumbnail grid for images, icon list for files, drag-and-drop upload with progress bar, per-file delete with confirmation, search and filter, window.FileManager.open(callback) API for any Summernote field. Full control, no vendor lock-in, no authentication edge cases.
DB browser module built: full phpMyAdmin alternative embedded in the admin panel for super-admin only. Table list, paginated data browse, structure view, row insert/edit/delete, SQL runner with Ctrl+Enter support, CSV and SQL INSERT export. Security: table names validated against allowlist and real DB tables, destructive SQL patterns audit-logged with warning banner in the UI, SQL runner rate-limited, export capped at 100,000 rows.
Server CLI: super admin now has full server tree access (root, var/log, usr/bin). PHP binary resolution hardened to try the versioned binary first, then fall back gracefully — fixes "command not found" errors on Hetzner where the web process PATH does not include the right PHP. 2FA removed from server CLI and maintenance actions (was blocking operations for accounts without 2FA configured).
Production: Qdrant vector database installed on the Hetzner server. Binary, config, systemd service, firewall rules. PHP IMAP extension installed via PECL for the email module (PHP 8.5 removed IMAP from core). Hetzner blocks outbound SMTP by default — support ticket submitted to unblock. Deploy workflow updated to group ownership model with setgid bit, so deployments no longer need elevated chown on writable directories.