chore: harden admin and add CI

SECURITY.md

@@ -0,0 +1,40 @@
+# Security
+
+## Secrets
+
+Do not commit real tokens, passwords, WARP+ keys, Telegram bot tokens, proxy secrets, backup passwords, or VPS credentials.
+
+Runtime secrets live on server:
+
+- `/root/pcatelegram_web-admin.password`
+- `/opt/pcatelegram_web/config.json`
+- `/opt/pcatelegram_web/warp.json`
+- `/opt/pcatelegram_web-bot/.env`
+- `/etc/telemt/config.toml`
+
+Important permissions:
+
+- auth file: `0600`
+- WARP config: `0600`
+- bot `.env`: `0600`
+- telemt config: `0600`
+
+## Web Admin
+
+Default install uses `admin` / `admin`. Change it in web-admin Settings after first login.
+
+Admin session cookie is `HttpOnly`, `SameSite=Lax`, and gains `Secure` when request comes through HTTPS reverse proxy via `X-Forwarded-Proto: https` or `X-Forwarded-Ssl: on`.
+
+Write APIs require `X-PCAtelegram-Web-Admin: 1` and JSON content type. Responses include security headers: CSP, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, and `Permissions-Policy`.
+
+## Public Site On Port 80
+
+Uploaded HTML is served publicly. Do not upload files with secrets, internal URLs, API tokens, private notes, or admin links.
+
+## Backups
+
+Backups can include proxy keys, WARP config, bot state, SSL files, admin panel files, and traffic history. Use encrypted backups for transport or off-server storage.
+
+## Reporting
+
+Report security issues privately to project owner. Do not open public issues with secrets or working exploit details.