feat(core,desktop,web,platform): migrate metrics to Core, rewrite Desktop UI, build Web dashboard

  - Move SystemMetricsService/ISystemMetricsService from Desktop → Trion.Core
  - Replace PerformanceCounter CPU sampling with native GetSystemTimes in WindowsMetricsProvider
  - Register Linux MySQL/Nginx-PHP services via PlatformServiceExtensions
  - Rewrite EmulatorAuthService to authenticate via Phoenix HTTP API instead of direct DB
  - Complete Desktop view/viewmodel rewrite: Settings, Dashboard, ServerControl, SinglePlayer
  - Add SparklineChart control, AvailablePackage and EmulatorProfile models
  - Replace Home.razor stub with full MudBlazor dashboard (infra status, CPU/RAM/disk/net)
  - Add Setup wizard pages, SetupGateMiddleware, ThemeSwitcher, and wwwroot assets to Trion.Web
  - Redesign Web layouts and Login page with MudBlazor
  - Add localization strings across EN/DE/RO
  - Update .gitignore: add servers/, Audit/, trion-db.json, webserver/

Author: fIyingPhoenix

.gitignore

@@ -78,14 +78,24 @@ bower_components/
 # Runtime Artifacts (app-generated)
 # ================================
 
-# TrionLogger output
+# TrionLogger / AuditLogger output
 Logs/
 logs/
+Audit/
 
 # MySQL portable install + config (created by MySqlSetupService at runtime)
 database/
 my.ini
 
+# Nginx + PHP portable install (created by NginxPhpSetupService at runtime)
+webserver/
+
+# Emulator server installations (created by EmulatorInstallerService at runtime)
+servers/
+
+# Runtime setup database config (written by SetupService at startup)
+trion-db.json
+
 # ================================
 # Secrets & Local Config
 # ================================
@@ -96,6 +106,8 @@ my.ini
 secrets.json
 appsettings.Local.json
 appsettings.*.local.json
+appsettings.Production.json
+**/appsettings.Production.json
 
 # ================================
 # SQLite / Database
@@ -147,3 +159,4 @@ issues_with_milestones.csv
 milestones_with_description.csv
 newplan.md
 plan.md
+/webserver

docs/api-webserver-integration.md

@@ -0,0 +1,210 @@
+# API — Web Server (nginx + PHP) Integration
+
+This document explains exactly what the Trion client expects from the backend API
+when serving the nginx and PHP portable packages, and what you need to add to the
+Flying-Phoenix API to make the **Download & Install** button work end-to-end.
+
+---
+
+## How the client downloads packages
+
+The client shares one generic download endpoint with MySQL, emulators, and all
+other packages.  The package is identified by the `emulator` query parameter.
+
+### Endpoint
+
+```
+GET /Trion/DownloadFile?emulator=<package>
+```
+
+The full URL is built in `ApiEndpoints.cs`:
+
+```csharp
+// src/Trion.Core/Constants/ApiEndpoints.cs
+
+public static string NginxDownloadUrl(string baseUrl) =>
+    $"{baseUrl}{DownloadFile}?emulator=nginx";
+
+public static string PhpDownloadUrl(string baseUrl) =>
+    $"{baseUrl}{DownloadFile}?emulator=php";
+```
+
+Both URLs are then surfaced through `AppLinks`:
+
+```csharp
+// src/Trion.Desktop/Models/AppLinks.cs
+
+public static string NginxApiDownloadUrl => ApiEndpoints.NginxDownloadUrl(ApiBaseUrl);
+public static string PhpApiDownloadUrl   => ApiEndpoints.PhpDownloadUrl(ApiBaseUrl);
+```
+
+### Request headers
+
+| Header      | Value                              | Required |
+|-------------|------------------------------------|----------|
+| `X-API-Key` | User's API key (supporter tier key) | No — omitted for guest/free tier |
+| `User-Agent` | `Mozilla/5.0 … TrionControlPanel/1.0` | Yes |
+
+### Expected response
+
+- **Status**: `200 OK`
+- **Body**: raw binary stream of the `.zip` file
+- **`Content-Length`**: strongly recommended — the client uses it to calculate
+  download progress percentage and ETA
+- **`Content-Type`**: `application/zip` or `application/octet-stream`
+
+The client writes the stream directly to a temp file and validates the ZIP magic
+bytes (`PK\x03\x04`) after download.  Minimum accepted file size is 512 KB —
+smaller responses are treated as corrupt and retried.
+
+### Fallback on API failure
+
+If the API returns a non-2xx status or times out, the client falls back to the
+CDN URLs defined in `ExternalLinks.cs`:
+
+```csharp
+// src/Trion.Core/Constants/ExternalLinks.cs
+
+public const string NginxVersion     = "1.28.2";
+public const string NginxCdnDownload = "https://nginx.org/download/nginx-1.28.2.zip";
+
+public const string PhpVersion       = "8.3.20";
+public const string PhpCdnDownload   =
+    "https://windows.php.net/downloads/releases/php-8.3.20-nts-Win32-vs16-x64.zip";
+```
+
+Update both the version constant **and** the CDN URL together whenever you
+upgrade a package.
+
+---
+
+## What the API must serve
+
+### `emulator=nginx`
+
+Serve the **Windows portable nginx** zip.  The client extracts it into
+`<appdir>/webserver/nginx/` and expects to find `nginx.exe` directly inside
+that folder (one level of nesting is automatically unwrapped during extraction).
+
+| Field           | Value |
+|-----------------|-------|
+| Current version | `1.28.2` |
+| Official source | `https://nginx.org/download/nginx-1.28.2.zip` |
+| Expected root   | `nginx-1.28.2\` (single top-level folder inside the zip) |
+| Key binary      | `nginx.exe` |
+
+The API can either:
+- Re-serve the upstream zip as-is (proxy/mirror), or
+- Host a pre-downloaded copy on the Flying-Phoenix CDN
+
+### `emulator=php`
+
+Serve the **Windows PHP NTS x64** zip.
+
+> **NTS (Non-Thread-Safe) is required.** The TS (Thread-Safe) build does not
+> work with php-cgi.exe in FastCGI mode.
+
+| Field           | Value |
+|-----------------|-------|
+| Current version | `8.3.20` |
+| Build variant   | NTS, Win32, VS16, x64 |
+| Official source | `https://windows.php.net/downloads/releases/php-8.3.20-nts-Win32-vs16-x64.zip` |
+| Expected root   | `php-8.3.20-nts-Win32-vs16-x64\` (single top-level folder) |
+| Key binary      | `php-cgi.exe` |
+
+---
+
+## Adding the handler to the API (example)
+
+The existing `/Trion/DownloadFile` endpoint likely already handles `emulator=mysql`.
+Add the two new cases to the same switch/map:
+
+```csharp
+// Example — adapt to your actual API framework
+
+app.MapGet("/Trion/DownloadFile", async (string emulator, HttpContext ctx) =>
+{
+    var (fileName, filePath) = emulator.ToLowerInvariant() switch
+    {
+        "mysql" => ("mysql-8.4.8-winx64.zip",                     _config["Packages:MySqlPath"]),
+        "nginx" => ("nginx-1.28.2.zip",                            _config["Packages:NginxPath"]),
+        "php"   => ("php-8.3.20-nts-Win32-vs16-x64.zip",          _config["Packages:PhpPath"]),
+        _       => throw new BadHttpRequestException("Unknown package")
+    };
+
+    ctx.Response.ContentType = "application/zip";
+    ctx.Response.Headers["Content-Disposition"] = $"attachment; filename=\"{fileName}\"";
+    await ctx.Response.SendFileAsync(filePath);
+});
+```
+
+If you proxy the upstream URL instead of hosting locally:
+
+```csharp
+"nginx" => await ProxyDownloadAsync(ctx, "https://nginx.org/download/nginx-1.28.2.zip"),
+"php"   => await ProxyDownloadAsync(ctx, "https://windows.php.net/downloads/releases/php-8.3.20-nts-Win32-vs16-x64.zip"),
+```
+
+---
+
+## Upgrading a package version
+
+When you want to ship a newer nginx or PHP version:
+
+1. Update the version constants and CDN URLs in the client:
+
+   ```csharp
+   // src/Trion.Core/Constants/ExternalLinks.cs
+   public const string NginxVersion     = "1.29.0";           // ← new version
+   public const string NginxCdnDownload = "https://nginx.org/download/nginx-1.29.0.zip";
+
+   public const string PhpVersion       = "8.3.21";
+   public const string PhpCdnDownload   = "https://windows.php.net/downloads/releases/php-8.3.21-nts-Win32-vs16-x64.zip";
+   ```
+
+2. Update the API to serve the new zip under the same `emulator=nginx` /
+   `emulator=php` keys.
+
+3. The client will detect the new zip at next install or reinstall — existing
+   installations are unaffected until the user clicks **Reinstall**.
+
+---
+
+## Supporter tier vs. free tier
+
+The client sends `X-API-Key` when the user has an API key stored
+(`AppSettings.AccountApiKey`).  The API can use this to:
+
+- Serve packages from a faster CDN for paying supporters
+- Apply rate-limiting on the free tier
+- Log download statistics per user
+
+If no key is present (guest / free user), the header is omitted.  The API
+**must still serve the zip** to keyless requests — the header is optional, not
+required for authentication.
+
+---
+
+## Client download flow (for reference)
+
+```
+InstallWebServerCommand (Settings → Web Server → Download & Install)
+    └─ RunStartupCheckAsync()
+        ├─ GET /Trion/DownloadFile?emulator=nginx  (X-API-Key if available)
+        │   ├─ 200 OK → stream to temp zip → extract to webserver/nginx/
+        │   └─ non-200  → fallback: GET https://nginx.org/download/nginx-1.28.2.zip
+        │
+        ├─ GET /Trion/DownloadFile?emulator=php    (X-API-Key if available)
+        │   ├─ 200 OK → stream to temp zip → extract to webserver/php/
+        │   └─ non-200  → fallback: GET https://windows.php.net/…
+        │
+        ├─ GenerateNginxConf()   → webserver/nginx/conf/nginx.conf
+        ├─ GeneratePhpIni()      → webserver/php/php.ini
+        ├─ GenerateSelfSignedCert() (if HTTPS enabled)
+        ├─ AppSettings.WebServerInstalled = true
+        └─ StartAsync()  →  php-cgi.exe -b 127.0.0.1:9000  +  nginx.exe
+```
+
+Progress text (including download speed and ETA) is streamed back through
+`INginxPhpSetupService.ProgressChanged` and displayed in the settings panel's
+progress bar while `IsWebServerBusy` is `true`.

res/icons/trion-logo/trion.ico

@@ -11,7 +11,7 @@ public static class AdminEndpoints
 {
     public static WebApplication MapAdminEndpoints(this WebApplication app)
     {
-        var g = app.MapGroup("/Trion/admin").WithTags("Admin");
+        var g = app.MapGroup("/Trion/admin").WithTags("Admin").RequireAuthorization("AdminPolicy");
 
         g.MapPost("supporter-key",  CreateSupporterKey);
         g.MapPost("upload-emulator", UploadEmulator);
@@ -111,7 +111,15 @@ await Task.Run(() =>
             foreach (var entry in archive.Entries)
             {
                 ct.ThrowIfCancellationRequested();
-                var target = Path.GetFullPath(Path.Combine(filesDir, entry.FullName));
+
+                // Reject symlinks (Unix mode 0xA000 in high 16 bits of ExternalAttributes)
+                if ((entry.ExternalAttributes >> 16 & 0xF000) == 0xA000) continue;
+
+                // Validate the relative path BEFORE combining to prevent Zip Slip
+                var relative = entry.FullName.Replace('\\', '/').TrimStart('/');
+                if (relative.Contains("..") || Path.IsPathRooted(relative)) continue;
+
+                var target = Path.GetFullPath(Path.Combine(filesDir, relative));
                 if (!target.StartsWith(baseDir, StringComparison.OrdinalIgnoreCase)) continue;
 
                 if (string.IsNullOrEmpty(entry.Name)) { Directory.CreateDirectory(target); continue; }
@@ -145,7 +153,10 @@ await Task.Run(() =>
     private static bool IsAdminKey(string? key, IConfiguration cfg)
     {
         var configured = cfg["AdminApiKey"];
-        return !string.IsNullOrEmpty(key) && key == configured;
+        if (string.IsNullOrEmpty(key) || string.IsNullOrEmpty(configured)) return false;
+        var a = System.Text.Encoding.UTF8.GetBytes(key);
+        var b = System.Text.Encoding.UTF8.GetBytes(configured);
+        return CryptographicOperations.FixedTimeEquals(a, b);
     }
 
     private static string NormalizeEmulatorName(string emulator) =>
@@ -177,7 +188,7 @@ await Task.WhenAll(files.Select(async f =>
                 var info     = new FileInfo(f);
                 var relative = Path.GetRelativePath(filesPath, f).Replace('\\', '/');
                 var dir      = Path.GetDirectoryName(relative)?.Replace('\\', '/') ?? "";
-                var hash     = await ComputeMd5Async(f, ct);
+                var hash     = await ComputeSha256Async(f, ct);
 
                 entries.Add(new
                 {
@@ -194,15 +205,13 @@ await Task.WhenAll(files.Select(async f =>
         return JsonSerializer.Serialize(new { files = entries.ToList() });
     }
 
-#pragma warning disable CA5351   // MD5 is used for file integrity, not security
-    private static async Task<string> ComputeMd5Async(string path, CancellationToken ct)
+    private static async Task<string> ComputeSha256Async(string path, CancellationToken ct)
     {
         await using var stream = new FileStream(
             path, FileMode.Open, FileAccess.Read, FileShare.Read, 4096, useAsync: true);
-        using var md5 = MD5.Create();
-        return BitConverter.ToString(await md5.ComputeHashAsync(stream, ct)).Replace("-", "").ToUpperInvariant();
+        using var sha = SHA256.Create();
+        return Convert.ToHexString(await sha.ComputeHashAsync(stream, ct));
     }
-#pragma warning restore CA5351
 
     private static int CountFiles(string manifestJson) =>
         manifestJson.Split("\"name\"").Length - 1;

src/Trion.API/Endpoints/AdminEndpoints.cs

@@ -15,8 +15,8 @@ public static WebApplication MapPackageEndpoints(this WebApplication app)
         g.MapGet("Ping", Ping);
         g.MapGet("GetExternalIPv4", GetExternalIPv4);
         g.MapGet("GetFileVersion",  GetFileVersion);
-        g.MapGet("DownloadFile",    DownloadFileGet).RequireRateLimiting("download");
-        g.MapPost("DownloadFile",   DownloadFilePost).RequireRateLimiting("download");
+        g.MapGet("DownloadFile",    DownloadFileGet).RequireRateLimiting("download").RequireRateLimiting("downloads-ip");
+        g.MapPost("DownloadFile",   DownloadFilePost).RequireRateLimiting("download").RequireRateLimiting("downloads-ip");
         g.MapPost("RepairSPP",      RepairSpp);
         g.MapGet("DownloadSpeedTest", DownloadSpeedTest);
 

src/Trion.API/Endpoints/PackageEndpoints.cs

@@ -40,7 +40,8 @@
         };
     });
 
-builder.Services.AddAuthorization();
+builder.Services.AddAuthorization(o =>
+    o.AddPolicy("AdminPolicy", p => p.RequireRole("admin")));
 
 // ── Rate limiting ─────────────────────────────────────────────────────────────
 builder.Services.AddRateLimiter(o =>
@@ -56,12 +57,21 @@
         opt.PermitLimit = 5;
         opt.QueueLimit  = 2;
     });
+    o.AddFixedWindowLimiter("downloads-ip", opt =>
+    {
+        opt.PermitLimit = 10;
+        opt.Window      = TimeSpan.FromMinutes(1);
+        opt.QueueLimit  = 0;
+    });
     o.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
 });
 
 // ── CORS ──────────────────────────────────────────────────────────────────────
 builder.Services.AddCors(o =>
-    o.AddDefaultPolicy(p => p.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader()));
+    o.AddDefaultPolicy(p => p
+        .WithOrigins("https://flying-phoenix.dev", "https://www.flying-phoenix.dev")
+        .AllowAnyMethod()
+        .AllowAnyHeader()));
 
 // ── Caching ───────────────────────────────────────────────────────────────────
 builder.Services.AddMemoryCache();
@@ -70,8 +80,8 @@
 // ── Allow large multipart uploads (admin upload-emulator endpoint) ─────────────
 builder.Services.Configure<Microsoft.AspNetCore.Http.Features.FormOptions>(o =>
 {
-    o.MultipartBodyLengthLimit = long.MaxValue;
-    o.ValueLengthLimit         = int.MaxValue;
+    o.MultipartBodyLengthLimit = 10L * 1024 * 1024 * 1024; // 10 GB — enough for any emulator package
+    o.ValueLengthLimit         = 128 * 1024;                // 128 KB for form fields
 });
 
 // ── OpenAPI / Swagger ─────────────────────────────────────────────────────────
@@ -103,6 +113,14 @@
 builder.Services.AddScoped<IUserService, UserService>();
 builder.Services.AddScoped<INewsService, NewsService>();
 
+// ── Startup validation: reject placeholder secrets ────────────────────────────
+var adminKey  = builder.Configuration["AdminApiKey"] ?? "";
+var secretKey = builder.Configuration["Jwt:SecretKey"] ?? "";
+if (adminKey.StartsWith("change-this") || secretKey.StartsWith("change-this"))
+    throw new InvalidOperationException(
+        "Default placeholder secrets detected. Set real values via environment variables " +
+        "(TRION_AdminApiKey, TRION_Jwt__SecretKey) before running in production.");
+
 // ── Build ─────────────────────────────────────────────────────────────────────
 var app = builder.Build();