v0.3.10 — Legacy LED fix for gate mode

Fix: GPIO 22/25 legacy LEDs now toggle correctly in gate mode.
Previously, gate access routed through gate_command() which never
touched the hardcoded LED pins — the keypad LED stayed red on
valid access. Now _set_legacy_leds() fires for both door and gate
paths: green during gate open cycle, back to red when done.

Also decoupled the legacy LED toggle from the lock relay check
so LEDs work even when latch_gpio isn't set (e.g., gate mode
where the lock relay is replaced by gate outputs).

Docs: added LED Feedback section to README wiring guide explaining
both the legacy hardcoded LEDs and the configurable Status LED.

v0.3.9 — React 19 + Vite 6 migration + Python requirements safety net

Major dependency migration:
- React 18.3.1 → 19.0.0
- react-dom 18.3.1 → 19.0.0
- @types/react 18.3.28 → 19.x
- @types/react-dom 18.3.7 → 19.x
- @vitejs/plugin-react 4.7.0 → 5.x (React 19 compat)
- Vite 5.4.21 → 6.x (Node 18+ required, Pi has 20.19.2)
- @tanstack/react-query 5.60 → 5.99

Build verified clean on Pi hardware: zero TypeScript errors, zero
npm audit vulnerabilities, SPA bundle produces correct output.

Python dependency management:
- New pidoors/requirements.txt (source of truth for controller deps)
- pidoors-update.sh now runs pip install -r requirements.txt on
  every update — future new Python dependencies install automatically
- install.sh uses requirements.txt for fresh installs
- Closes the "new import in future release crashes existing controllers"
  gap identified in the dependency audit

v0.3.8 — Auto-close, dashboard gate controls, session fix

Gate auto-close:
- New optional clearance sensor input (4th gate input) for beam-break,
  IR, or laser sensors at the gate opening
- Configurable polarity and "active means clear/blocked" logic
- New auto_close section in gate config: enable + delay (1-3600s)
- Mandatory safety: auto-close requires a clearance sensor — UI greys
  out the toggle, API rejects enable requests, controller refuses to
  fire if sensor is missing or path is blocked
- Auto-close fires after gate transitions to 'open' state if all
  conditions are met
- Sensor breaking cancels the timer; clearing restarts it
- Any manual command (open/close/stop/hold) cancels pending auto-close
- Releasing hold while gate is open restarts the auto-close timer

Dashboard:
- Door status panel now mirrors the doors page for gates: gate state
  badge, held badge, and Open/Stop/Close/Hold/Release buttons
- Dashboard API now returns is_gate, gate_state, gate_held fields

Session timeout fix:
- session_timeout=0 (unlimited) now actually works
- Sessions stored in /var/lib/php/pidoors-sessions to bypass Debian's
  phpsessionclean cron which would otherwise delete idle sessions
  after 24 minutes regardless of the app-level setting
- session.gc_maxlifetime configured per-request to match app setting
- install.sh and server-update.sh create the custom save path

v0.3.7 — Actionable gate command errors + live state sync

Gate commands now return a (ok, reason) tuple from the controller
so the web UI can display specific error messages instead of a
generic "refused" fallback:

- 'held' → "Gate is held. Release the hold first."
- 'no_output_configured' → "No output pin is configured for this
  direction. Open the door settings and assign a pin..."
- 'already_running' → "Gate is already opening/closing."

Server-side polling (poll_all_door_status and ping_controller)
now reads gate_state and gate_held from the controller's /ping
response and writes them to the DB. This means the Held badge
and current gate state update on the next 5-second UI poll
instead of waiting for the 5-minute heartbeat.

Gate command endpoint also writes the controller's response
state to the DB immediately, so the UI reflects new state on
the next poll instead of showing stale info.

Distinguishes transport failure (fallback=true) from
controller-reached-but-refused (ok=false with state in response).

v0.3.6 — Fix SPA cache + auto nginx config upgrade on update

index.html now sent with Cache-Control: no-cache so browsers always
re-check it after an update. Hashed JS/CSS continues to cache for
a year. Fixes stale UI after server updates.

Web UI updates now also upgrade the nginx config when it's changed.
New /usr/local/sbin/pidoors-nginx-upgrade helper (installed by
install.sh and server-update.sh) runs as root via a narrow sudoers
entry. The web UI updater detects nginx config drift, calls the
helper, and nginx is reloaded automatically.

Also fixes a Python SyntaxError in the controller's rename handler
(nested 'global zone' declaration) introduced in 0.3.5.

Fix status LED pin selector type error

v0.3.3 — Gate mode, status LED, install fixes

Add gate mode for doors with rolling/sliding gates: 3 configurable
inputs (open/stop/close physical buttons), 3 configurable outputs
(open/stop/close relays), per-pin GPIO assignment, hi/lo polarity,
hold duration, debounce, triple-tap window, pull-resistor type.

Triple-tap on physical inputs enters hold state. Gate state machine
tracks current state (idle/opening/closing/stopped/open/closed) and
held flag. Web UI shows gate state badge and dedicated open/close/
stop/hold/release buttons. Card scans on a gate trigger the open
output. Master card 3-scan = hold open, 1-scan = release.

Add universal status LED feature (separate from gate mode) — fires
on access events and during hold states, configurable per door.

Server-side pin conflict checker prevents double-assigning GPIO
pins across reader, sensor, lock relay, gate I/O, and status LED.

New global settings: master_scans_hold_open (default 3) and
master_scans_release_hold (default 1) under Controller > Master
Card Behavior in the settings page.

Install fixes: shell scripts now have executable bit in git (no
more chmod +x needed before running). Installer prompts to start
the door controller service at the end and tails logs briefly.

Push timeout increased from 3s to 5s to accommodate slow TLS
handshakes on Pi Zero hardware.

v3.2.0 — Reliable controller self-updates

Two root causes prevented push-triggered updates from completing:

1. Cgroup detection: the update script checked for 'pidoors.service'
   in /proc/self/cgroup, but when launched via systemd-run --scope,
   the cgroup shows 'run-pXXXX.scope' instead. Now matches both
   patterns.

2. PrivateTmp: pidoors.service uses PrivateTmp=true, so /tmp/ is
   ephemeral. The update script's temp dir was destroyed when the
   service stopped. Now uses /var/cache/ instead.

Self-update also patches older releases with both fixes, so
controllers on any prior version can upgrade to this release.

Verified end-to-end on live Pi hardware: push from server →
controller self-detaches → downloads v3.2.0 → stops service →
copies files → re-signs TLS cert → runs migration → restarts →
reports success.

v3.1.9 — Update script self-detaches from service cgroup

The update script now detects if it's running inside the
pidoors.service cgroup and re-launches itself as an independent
systemd transient service before proceeding. This ensures the
update survives systemctl stop pidoors regardless of how it was
launched (push, heartbeat, or manual).

Also patches older release scripts during self-update to inject
the cgroup detach and venv python fixes, so controllers on any
prior version can successfully self-update.

v3.1.8 — Fix update script killed by systemd cgroup

Use systemd-run to create a transient service (not --scope) for the
update script. This fully escapes the pidoors.service cgroup so the
updater survives systemctl stop pidoors. The --scope approach still
ran within the cgroup lifecycle; a transient service is independent.

Verified end-to-end: push update from server → controller downloads
release → stops service → copies files → re-signs TLS cert →
runs migration → restarts service → reports success. Zero user
intervention.