Require dashboard authentication and harden scrape URL handling

[devin-ai-integration]

Summary

• require dashboard authentication before every Streamlit entrypoint renders
• support a salted PBKDF2-HMAC-SHA256 verifier, while failing closed on missing or malformed verifier configuration
• preserve current main's VPS runtime-only navigation and local authoring surfaces
• restrict Autotrader page actions to HTTPS autotrader.com.au targets
• restore default Streamlit CORS/XSRF protections and launch the supported app.py entrypoint in the devcontainer
• update requests to 2.33.1
• add direct gate-execution, credential, navigation, devcontainer, and URL-validation regressions

Rebuild

The original branch predated PRs #10-#16 and conflicted with current main. It has been rebuilt through merge commit 7e24951, which retains the original PR history and current main as parents while using the fully tested 12-file authentication tree.

Validation

• requests runtime: 2.33.1
• focused authentication/navigation/Autotrader suite: 22 passed
• full suite: 964 passed, 1 expected xfail
• Ruff: passed
• Python compileall: passed
• readiness smoke: passed
• governance: 408/408 observed tags covered, 0 errors
• project-memory check: passed
• staged project-memory and commit-hygiene checks: passed
• Git diff check: passed

Credential and runtime boundary

Do not merge/deploy this PR until the operator confirms possession of the dashboard password or a replacement password is generated and safely retained. A PBKDF2 verifier alone cannot recover the password.

Merging this PR does not deploy it. After credential confirmation, merge to main, deploy through the governed VPS release, then verify unauthenticated blocking, successful login, service health, and daily/hourly timers without changing VPS-owned runtime data.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 703b775b8f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Fail closed outside the detected VPS

When this same Streamlit app is published anywhere other than /opt/autosniper without explicitly setting AUTOSNIPER_VPS_MODE (for example the README still advertises Streamlit Cloud hosting, and the devcontainer forwards port 8501), a missing dashboard password falls through to OPEN, so those public deployments still render the scraper/model/dataset controls anonymously. Treating every non-VPS path as local leaves the access-control fix dependent on an easy-to-miss deployment flag; the policy should fail closed for hosted/non-loopback environments or require an explicit local opt-out.

Useful? React with 👍 / 👎.