feat: security hardening, production roadmap, admin panel v1

Client security fixes (cmd/tailscale-tray/main.go):
- SSRF protection in Add Server dialog (validateControlURL): reject
  private/loopback/link-local/cloud-metadata IPs via DNS resolution
- RCE gate on AuthURL/BrowseToURL exec paths (validateAuthURL)
- Sanitized URL logging (sanitizeURLForLog drops query auth tokens)
- Error handling on exec.Command with user-facing showError()

Admin panel security (web-admin):
- Bcrypt password hashing (replaces SHA256)
- Rate limiting: 5 failed logins → 15-min lockout
- Session + login attempt cleanup goroutine (hourly)
- url.QueryEscape / encodeURIComponent for all API params
- Fail-hard startup when no TLS and non-loopback bind
- ADMIN_PASSWORD required (no default), password min 12 chars
- Username regex whitelist

Installer hardening (Setup.wxs):
- util:PermissionEx restricts SCM access: only Administrators +
  SYSTEM can start/stop/reconfigure service. Authenticated Users
  limited to QueryStatus/QueryConfig/Interrogate
- Vital="yes" on ServiceInstall

Docs & roadmap:
- PRODUCTION_ROADMAP.md: 5-milestone plan (security + features +
  distribution + ops) with granular tasks, effort, done-when
- CLIENT_SECURITY_AUDIT.md, SECURITY_FIXES.md, DEPLOYMENT.md
- AI assistant rules (.cursorrules, .antigravityrules, etc.)

Build & distribution:
- build-msi.ps1, deploy-and-sign.ps1, sign-release.ps1
- redeploy.ps1, tray-deploy.ps1, test-msi.ps1
- installer/msi/ alternative WXS setup
- Restored .github/workflows/ removed in mirror cleanup

.gitignore hardened: *.pfx, *.p12, *.key, *.pem, .env*

.agent/workflows/Disk_Cleanup_Workflow_Knowledge.md

@@ -0,0 +1,69 @@
+# Disk Cleanup Workflow Knowledge
+
+## Overview
+This document serves as the AI knowledge base for the `Disk_Cleanup_Workflow.bat` script. Its purpose is to allow any AI assistant in the future to understand the developer-centric disk cleanup logic, explain it to the user, or fully reconstruct the batch script if it is ever lost or needs to be ported.
+
+## Context & Problem
+Developer environments (particularly those running .NET, Node.js, and Docker) accumulate massive amounts of cached files. Over time, this leads to the `C:\` drive becoming critically full (e.g., `< 100MB` remaining), causing system unresponsiveness. Standard Windows Disk Cleanup does not empty backend developer caches.
+
+## Target Areas for Cleanup
+This workflow specifically targets:
+1. **NuGet Cache:** Purges `.NET` local packages, which can take tens of GBs.
+2. **NPM Cache:** Force cleans `Node.js` caches.
+3. **User Temp Directory:** Empties `%TEMP%`.
+4. **Windows Temp Directory:** Empties `C:\Windows\Temp`.
+5. **Browser Caches:** Empties Google Chrome and Microsoft Edge user data caches to free up space from extensive web usage.
+6. **Recycle Bin:** Empties the Windows Recycle Bin using a silent PowerShell command.
+7. **Docker Images/Volumes:** Removes **ALL** unused containers, networks, dangling images, and unreferenced images (`-a` flag ensures full cleanup of old images).
+
+## Batch Script Source Code
+```bat
+@echo off
+chcp 65001 >nul
+title Disk Cleanup Workflow (Developer Edition)
+echo ======================================================================
+echo           WORKFLOW DỌN DẸP Ổ ĐĨA TỰ ĐỘNG - DÀNH CHO LẬP TRÌNH VIÊN 
+echo ======================================================================
+echo.
+
+echo [1/7] Dang xoa NuGet Cache (.NET)...
+dotnet nuget locals all --clear
+
+echo.
+echo [2/7] Dang xoa NPM Cache (Node.js)...
+call npm cache clean --force
+
+echo.
+echo [3/7] Dang don dep thu muc Temp cua User...
+rmdir /s /q "%TEMP%" >nul 2>&1
+mkdir "%TEMP%" >nul 2>&1
+
+echo.
+echo [4/7] Dang don dep thu muc Temp cua Windows (Can Run As Administrator de xoa het)...
+rmdir /s /q "C:\Windows\Temp" >nul 2>&1
+mkdir "C:\Windows\Temp" >nul 2>&1
+
+echo.
+echo [5/7] Dang don dep Cache trinh duyet (Chrome / Edge)...
+rmdir /s /q "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache" >nul 2>&1
+rmdir /s /q "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Code Cache" >nul 2>&1
+rmdir /s /q "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache" >nul 2>&1
+rmdir /s /q "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache" >nul 2>&1
+
+echo.
+echo [6/7] Dang lam trong Thung rac (Recycle Bin)...
+PowerShell.exe -NoProfile -Command "Clear-RecycleBin -Force -ErrorAction SilentlyContinue"
+
+echo.
+echo [7/7] Dang don dep lich su Docker (Xoa TOAN BO image, container, volume cu)...
+echo (Bo qua tuy chon nay neu ban khong dung Docker)
+docker system prune -a -f >nul 2>&1
+
+echo.
+echo ======================================================================
+echo                   HOÀN TẤT DỌN DẸP!
+echo ======================================================================
+echo Phân vùng ổ C của bạn đã được giải phóng dung lượng.
+echo Bấm phím bất kỳ để thoát...
+pause >nul
+```