Iteration 4
Talpie Smart Home Core
Standalone server
Web shell is ready
The core is running with Undertow, MariaDB, HikariCP, Thymeleaf templates, static resources, DB-backed login sessions, secure cookies and CSRF guard.
Password change required
The bootstrap admin was created with password_must_change. The dedicated change-password
screen lands with the next security/admin iteration, but the flag is already persisted in DB.
Authentication baseline
Iteration 4 adds users, groups, DB-backed sessions, secure cookies, CSRF for /web-api state changes, login audit and a bootstrap admin user. /dev-api and /tv-api remain excluded from web-session and CSRF.