Unify GateSentry admin UI with Carbon

[fifthsegment]

Summary

Release GateSentry 2.3.0 with a unified Carbon administration interface across the existing application routes. This keeps route URLs and backend contracts intact while establishing consistent page composition, feedback, responsive behavior, and accessible workflows on desktop and tablet.

Included

• Shared PageShell, SectionPanel, ResourceState, AuthShell, and ConfirmDialog primitives, plus consistent global spacing, notification placement, local overflow, and responsive behavior
• Protected setup/session routing, dedicated Login and Setup composition, base-path-aware navigation and certificate downloads, discoverable /excludeurls, and page-not-found recovery
• Reworked Overview, Stats, Logs, and Services pages with concise hierarchy, explicit resource states, and bounded dense content
• Settings organized into General, HTTPS inspection, Connectivity, and Diagnostics tabs, including certificate and Raspberry Pi storage guidance
• Policies rebuilt around starter templates, assignments, defaults, policy testing, readable rules, and tablet-reachable editing actions
• Devices rebuilt as a compact inventory with explicit loading/error/empty states, Carbon confirmations, tabbed detail views, preserved assignment/Tailscale behavior, and polling that stops on close or device change
• DNS and all four HTTPS inspection routes rebuilt with semantic status/refresh controls, validated CRUD, stable edit identity, sibling navigation, scope guidance, and locally scrolling tables/editors
• AI image filtering rebuilt around provider selection and status; Proxy users rebuilt around clear identity/enforcement state and Carbon CRUD
• Embedded administration assets rebuilt and synchronized
• GATESENTRY_VERSION bumped to 2.3.0 with matching release notes in CHANGELOG.md

Preserved contracts

• Existing route URLs and top-level destinations
• Svelte 4, Carbon v10, and the current Go/API architecture
• Authentication/setup, settings, filter IDs and payloads, policy serialization/evaluation, device assignment, Tailscale linking, DNS refresh, and activity/inventory polling semantics
• Server-rendered proxy block page remains out of scope
• External AI processing remains disabled by default and clearly disclosed

Validation

• make verify — passed
  • Svelte check: 0 errors, 0 warnings
  • Vitest: 15 files, 71 tests passed
  • Embedded asset build and validation: passed
  • Go application and proxy tests: passed
  • Go build: passed
• make validate-assets — passed
• git diff --check origin/master...HEAD — passed
• Commit identity validation passed across the branch
• All PR checks passed for the final 2.3.0 revision
• Playwright MCP inspected responsive Login at 390×844 and 820×1180 with no document-level overflow. A complete authenticated route sweep remains outstanding because browser credential entry was denied by the session permission classifier.

Release behavior

Merging this PR changes the version from 2.2.2 to 2.3.0. The release workflow will tag v2.3.0, publish these changelog notes, and build/push the release artifacts. No configuration migration is required.

🤖 Generated with [CC]

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.10%. Comparing base (e8fe85e) to head (e41c1b6).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #190   +/-   ##
=======================================
  Coverage   51.09%   51.10%           
=======================================
  Files         128      128           
  Lines       12669    12669           
=======================================
+ Hits         6473     6474    +1     
+ Misses       5417     5415    -2     
- Partials      779      780    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.