refactor: reorganize Control Room navigation

- Consolidate Containers and Proxy Hosts under "Stack" section
- Add "Data Management" section with database browser placeholders:
  PostgreSQL, Redis, Qdrant, Neo4j
- Remove unused nav items: Networks, Volumes, Images (Portainer),
  Redirections, Streams, Certificates (NPM)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

AGENTS.md

@@ -59,10 +59,8 @@ This project uses version-tag-based CI/CD. Releases trigger automated Docker bui
 3. Commit changes: `git commit -m "chore: release vX.X.X"`
 4. Create git tag: `git tag vX.X.X`
 5. Push with tags: `git push origin master --tags`
-6. Create release in Gitea UI (git.schweitz.net → Releases → New Release)
+
-   * Select the tag
+CI/CD auto-triggers when a tag starting with `v` is pushed.
-   * Add release notes (can copy from CHANGELOG)
-   * **Publish** the release (this triggers CI/CD)
 
 **What happens on release:**
 

CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.12] - 2026-01-04
+
+### Changed
+- Control Room navigation reorganized:
+  - New "Stack" section with Containers and Proxy Hosts
+  - New "Data Management" section with PostgreSQL, Redis, Qdrant, Neo4j placeholders
+  - Removed: Networks, Volumes, Images (Portainer) and Redirections, Streams, Certificates (NPM)
+
+## [1.1.11] - 2026-01-04
+
+### Fixed
+- API client providers now use `keepAlive: true` to prevent Ref invalidation
+  - Fixes "DioException [unknown]: null" error on /security/users and other API pages
+  - AuthInterceptor's stored Ref was becoming invalid when provider auto-disposed
+
+## [1.1.10] - 2026-01-04
+
+### Changed
+- Removed page swipe transitions - all navigation is now instant (NoTransitionPage)
+
+## [1.1.9] - 2026-01-04
+
+### Changed
+- Moved health check to `/health` directory - URL is now `/health` instead of `/health.html`
+  - Enables NPM forward auth path exclusion for health endpoint
+
 ## [1.1.8] - 2026-01-04
 
 ### Changed

lib/core/api/api_client.dart

@@ -9,7 +9,10 @@ import 'api_client_native.dart' if (dart.library.html) 'api_client_web.dart'
 part 'api_client.g.dart';
 
 /// Provides the Dio instance for Core API.
-@riverpod
+///
+/// Uses keepAlive to prevent auto-dispose - the AuthInterceptor stores
+/// a Ref that must remain valid for the lifetime of API requests.
+@Riverpod(keepAlive: true)
 Dio coreApiClient(Ref ref) {
   final options = BaseOptions(
     baseUrl: AppConfig.coreApiUrl,
@@ -33,7 +36,10 @@ Dio coreApiClient(Ref ref) {
 }
 
 /// Provides the Dio instance for Tatlock API.
-@riverpod
+///
+/// Uses keepAlive to prevent auto-dispose - the AuthInterceptor stores
+/// a Ref that must remain valid for the lifetime of API requests.
+@Riverpod(keepAlive: true)
 Dio tatlockApiClient(Ref ref) {
   final options = BaseOptions(
     baseUrl: AppConfig.tatlockApiUrl,

lib/features/control_room/presentation/pages/control_room_page.dart

@@ -69,44 +69,11 @@ class _SectionContent extends ConsumerWidget {
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
-    switch (nav) {
+    return switch (nav) {
-      case ControlRoomNav.containers:
+      ControlRoomNav.containers => const _ContainersSection(),
-        return const _ContainersSection();
+      ControlRoomNav.proxyHosts => const ProxyHostsPage(),
-      case ControlRoomNav.proxyHosts:
+      _ => _PlaceholderSection(nav: nav),
-        return const ProxyHostsPage();
+    };
-      default:
-        return _PlaceholderSection(nav: nav);
-    }
-  }
-}
-
-/// Containers section with optional stack filter.
-class _ContainersSection extends ConsumerWidget {
-  const _ContainersSection();
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    final selectedStack = ref.watch(selectedStackProvider);
-    final colorScheme = Theme.of(context).colorScheme;
-
-    return Row(
-      children: [
-        // Stacks filter panel
-        const _StacksFilterPanel(),
-        // Divider
-        VerticalDivider(
-          width: 1,
-          thickness: 1,
-          color: colorScheme.outlineVariant,
-        ),
-        // Main content - containers list or stack detail
-        Expanded(
-          child: selectedStack == null
-              ? const ContainersListPage()
-              : StackDetailPage(stackId: selectedStack),
-        ),
-      ],
-    );
   }
 }
 
@@ -150,6 +117,36 @@ class _PlaceholderSection extends StatelessWidget {
   }
 }
 
+/// Containers section with optional stack filter.
+class _ContainersSection extends ConsumerWidget {
+  const _ContainersSection();
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final selectedStack = ref.watch(selectedStackProvider);
+    final colorScheme = Theme.of(context).colorScheme;
+
+    return Row(
+      children: [
+        // Stacks filter panel
+        const _StacksFilterPanel(),
+        // Divider
+        VerticalDivider(
+          width: 1,
+          thickness: 1,
+          color: colorScheme.outlineVariant,
+        ),
+        // Main content - containers list or stack detail
+        Expanded(
+          child: selectedStack == null
+              ? const ContainersListPage()
+              : StackDetailPage(stackId: selectedStack),
+        ),
+      ],
+    );
+  }
+}
+
 /// Stacks filter panel for Containers section (includes "All Containers" option).
 class _StacksFilterPanel extends ConsumerWidget {
   const _StacksFilterPanel();

lib/features/control_room/router.dart

@@ -1,35 +1,32 @@
 import 'package:flutter/material.dart';
 import 'package:go_router/go_router.dart';
 import 'package:tatlock_ui/features/control_room/presentation/pages/control_room_page.dart';
+import 'package:tatlock_ui/routing/app_router.dart';
 import 'package:tatlock_ui/shared/layouts/widgets/nav_panel.dart';
 
 /// Route paths for Control Room.
 abstract class ControlRoomRoutes {
   static const base = '/control-room';
-  // Portainer
+  // Stack
   static const containers = '/control-room/containers';
-  static const networks = '/control-room/networks';
-  static const volumes = '/control-room/volumes';
-  static const images = '/control-room/images';
-  // NPM
   static const proxyHosts = '/control-room/proxy-hosts';
-  static const redirections = '/control-room/redirections';
+  // Data Management
-  static const streams = '/control-room/streams';
+  static const postgres = '/control-room/postgres';
-  static const certificates = '/control-room/certificates';
+  static const redis = '/control-room/redis';
+  static const qdrant = '/control-room/qdrant';
+  static const neo4j = '/control-room/neo4j';
 }
 
 /// Control Room navigation items with section grouping.
 enum ControlRoomNav {
-  // Portainer section
+  // Stack section - Docker containers and reverse proxy
-  containers('containers', 'Containers', Icons.dns, 'Portainer'),
+  containers('containers', 'Containers', Icons.dns, 'Stack'),
-  networks('networks', 'Networks', Icons.hub, 'Portainer'),
+  proxyHosts('proxy-hosts', 'Proxy Hosts', Icons.public, 'Stack'),
-  volumes('volumes', 'Volumes', Icons.storage, 'Portainer'),
+  // Data Management section - Database browsers
-  images('images', 'Images', Icons.photo_library, 'Portainer'),
+  postgres('postgres', 'PostgreSQL', Icons.table_chart, 'Data Management'),
-  // NPM section
+  redis('redis', 'Redis', Icons.memory, 'Data Management'),
-  proxyHosts('proxy-hosts', 'Proxy Hosts', Icons.public, 'NPM'),
+  qdrant('qdrant', 'Qdrant', Icons.scatter_plot, 'Data Management'),
-  redirections('redirections', 'Redirections', Icons.alt_route, 'NPM'),
+  neo4j('neo4j', 'Neo4j', Icons.hub, 'Data Management');
-  streams('streams', 'Streams', Icons.stream, 'NPM'),
-  certificates('certificates', 'SSL Certificates', Icons.verified_user, 'NPM');
 
   const ControlRoomNav(this.id, this.label, this.icon, this.section);
 
@@ -66,7 +63,8 @@ List<RouteBase> controlRoomRoutes() {
       GoRoute(
         path: nav.path,
         name: 'controlRoom${_capitalize(nav.id.replaceAll('-', '_'))}',
-        builder: (context, state) => ControlRoomPage(nav: nav),
+        pageBuilder: (context, state) =>
+            noTransitionPage(context, state, ControlRoomPage(nav: nav)),
       ),
   ];
 }

lib/features/security/router.dart

@@ -1,6 +1,7 @@
 import 'package:flutter/material.dart';
 import 'package:go_router/go_router.dart';
 import 'package:tatlock_ui/features/security/presentation/pages/security_page.dart';
+import 'package:tatlock_ui/routing/app_router.dart';
 import 'package:tatlock_ui/shared/layouts/widgets/nav_panel.dart';
 
 /// Route paths for Security room.
@@ -60,7 +61,8 @@ List<RouteBase> securityRoutes() {
       GoRoute(
         path: nav.path,
         name: 'security${_capitalize(nav.id.replaceAll('-', '_'))}',
-        builder: (context, state) => SecurityPage(nav: nav),
+        pageBuilder: (context, state) =>
+            noTransitionPage(context, state, SecurityPage(nav: nav)),
       ),
   ];
 }

lib/main.dart

@@ -14,10 +14,7 @@ void main() async {
   // Use path-based URLs on web (no-op on mobile/desktop)
   configureUrlStrategy();
 
-  developer.log(
+  debugPrint('🪣 ${AppVersion.name} v${AppVersion.fullVersion}');
-    '${AppVersion.name} v${AppVersion.fullVersion}',
-    name: 'tatlock_ui',
-  );
 
   // Initialize auth before starting the app.
   // This handles OIDC callback and silent auth on web.

lib/routing/app_router.dart

@@ -8,6 +8,14 @@ import 'package:tatlock_ui/shared/layouts/app_scaffold.dart';
 
 part 'app_router.g.dart';
 
+/// No-animation page builder for instant transitions
+Page<void> noTransitionPage(BuildContext context, GoRouterState state, Widget child) {
+  return NoTransitionPage<void>(
+    key: state.pageKey,
+    child: child,
+  );
+}
+
 /// Route paths as constants.
 abstract class AppRoutes {
   static const frontHall = '/';
@@ -29,21 +37,22 @@ GoRouter appRouter(Ref ref) {
           GoRoute(
             path: AppRoutes.frontHall,
             name: 'frontHall',
-            builder: (context, state) => const FrontHallPage(),
+            pageBuilder: (context, state) =>
+                noTransitionPage(context, state, const FrontHallPage()),
           ),
           ...controlRoomRoutes(),
           ...securityRoutes(),
           GoRoute(
             path: AppRoutes.parlor,
             name: 'parlor',
-            builder: (context, state) =>
+            pageBuilder: (context, state) =>
-                const _PlaceholderPage(title: 'Parlor'),
+                noTransitionPage(context, state, const _PlaceholderPage(title: 'Parlor')),
           ),
           GoRoute(
             path: AppRoutes.settings,
             name: 'settings',
-            builder: (context, state) =>
+            pageBuilder: (context, state) =>
-                const _PlaceholderPage(title: 'Settings'),
+                noTransitionPage(context, state, const _PlaceholderPage(title: 'Settings')),
           ),
         ],
       ),

npm-config.conf

@@ -0,0 +1,53 @@
+# Increase buffer size for large headers from Authentik
+proxy_buffers 8 16k;
+proxy_buffer_size 32k;
+
+# Exclude static assets from forward auth
+# These paths bypass auth_request but still proxy to upstream
+location ~ ^/(manifest\.json|favicon\.(ico|png)|health|icons|assets) {
+    auth_request off;
+    proxy_pass $forward_scheme://$server:$port;
+}
+
+# Forward authentication via standalone outpost
+auth_request /outpost.goauthentik.io/auth/nginx;
+error_page 401 = @goauthentik_proxy_signin;
+
+# Capture auth response headers
+auth_request_set $auth_cookie $upstream_http_set_cookie;
+auth_request_set $authentik_username $upstream_http_x_authentik_username;
+auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
+auth_request_set $authentik_email $upstream_http_x_authentik_email;
+auth_request_set $authentik_name $upstream_http_x_authentik_name;
+auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
+
+# Forward auth headers to application
+add_header Set-Cookie $auth_cookie;
+proxy_set_header X-authentik-username $authentik_username;
+proxy_set_header X-authentik-groups $authentik_groups;
+proxy_set_header X-authentik-email $authentik_email;
+proxy_set_header X-authentik-name $authentik_name;
+proxy_set_header X-authentik-uid $authentik_uid;
+
+# Outpost proxy location
+location /outpost.goauthentik.io {
+    proxy_pass https://localhost:9444/outpost.goauthentik.io;
+    proxy_set_header Host $host;
+    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+
+    # WebSocket support
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+}
+
+# Signin redirect handler
+location @goauthentik_proxy_signin {
+    internal;
+    return 302 /outpost.goauthentik.io/start?rd=$request_uri;
+}

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.1.8+1
+version: 1.1.12+1
 
 environment:
   sdk: ^3.10.4

tool/generate_health_json.dart

@@ -1,5 +1,5 @@
 #!/usr/bin/env dart
-// Generates web/health.json from pubspec.yaml
+// Generates web/health/health.json from pubspec.yaml
 // Run: dart run tool/generate_health_json.dart
 
 // ignore_for_file: avoid_print
@@ -37,15 +37,15 @@ void main() {
     'fullVersion': '$version+$buildNumber',
   };
 
-  final webDir = Directory('web');
+  final healthDir = Directory('web/health');
-  if (!webDir.existsSync()) {
+  if (!healthDir.existsSync()) {
-    webDir.createSync(recursive: true);
+    healthDir.createSync(recursive: true);
   }
 
-  final healthFile = File('web/health.json');
+  final healthFile = File('web/health/health.json');
   healthFile.writeAsStringSync(
     const JsonEncoder.withIndent('  ').convert(health),
   );
 
-  print('Generated web/health.json with version $version+$buildNumber');
+  print('Generated web/health/health.json with version $version+$buildNumber');
 }

web/health/health.json

@@ -0,0 +1,8 @@
+{
+  "status": "healthy",
+  "name": "tatlock_ui",
+  "title": "Tatlock - a Home Lab AI",
+  "version": "1.0.4",
+  "buildNumber": 1,
+  "fullVersion": "1.0.4+1"
+}

web/health/index.html

@@ -13,7 +13,7 @@
   <h1 id="status">Loading...</h1>
   <pre id="data"></pre>
   <script>
-    fetch('/health.json')
+    fetch('./health.json')
       .then(r => r.json())
       .then(data => {
         document.getElementById('status').textContent = data.status?.toUpperCase() || 'OK';