v0.35.1: performance, AGPL licensing and documentation overhaul

- Web Server reads static files inline; proxy middleware chain flattened
- About window with license summary and project links; AGPL-3.0-or-later
- Rewritten documentation: feature list, screenshots, performance guide
- Fix false spikes in per-Vhost request-rate charts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MMsgSXoK4Bph2vU6fSBkAH

integrations/opnsense-acme/opnsense-rustproxy-cert-deploy.sh

@@ -1,8 +1,7 @@
 #!/bin/sh
 set -eu
 
-# Deploy an externally issued OPNsense/os-acme-client certificate to RustProxy 0.23.x.
-# Configuration is kept separately so the API token does not need to live in this script.
+# Deploy an OPNsense os-acme-client certificate to RustProxy; settings live in a separate file.
 
 CONFIG_FILE="${RUSTPROXY_ACME_CONFIG:-/usr/local/etc/rustproxy-acme.conf}"
 
@@ -62,10 +61,7 @@ KEY_PUB=$(
 "$OPENSSL" x509 -in "$CERT_FILE" -checkend 0 -noout >/dev/null 2>&1 \
     || fail "Certificate is already expired"
 
-# Always reconcile with RustProxy. The deploy endpoint is idempotent: an identical
-# RustProxy-owned generation is a server-side no-op, while a missing certificate id
-# is created and a changed manual certificate is rotated atomically. This avoids
-# trusting stale local state when the RustProxy configuration was changed separately.
+# The deploy endpoint is idempotent, so always reconcile instead of trusting local state.
 
 umask 077
 TMP_JSON=$(mktemp "${TMPDIR:-/tmp}/rustproxy-cert.XXXXXX") || fail "mktemp failed"
@@ -73,8 +69,7 @@ TMP_CURL=$(mktemp "${TMPDIR:-/tmp}/rustproxy-curl.XXXXXX") || { rm -f "$TMP_JSON
 TMP_RESPONSE=$(mktemp "${TMPDIR:-/tmp}/rustproxy-response.XXXXXX") || { rm -f "$TMP_JSON" "$TMP_CURL"; fail "mktemp failed"; }
 trap 'rm -f "$TMP_JSON" "$TMP_CURL" "$TMP_RESPONSE"' EXIT HUP INT TERM
 
-# PEM is line-oriented Base64 plus BEGIN/END markers. Escape it as a JSON string
-# without needing jq/python on OPNsense.
+# Escape PEM as a JSON string without jq/python.
 pem_json() {
     awk '{
         gsub(/\\/, "\\\\");
@@ -114,8 +109,7 @@ if [ -n "${RUSTPROXY_CACERT:-}" ]; then
     printf 'cacert = "%s"\n' "$RUSTPROXY_CACERT" >> "$TMP_CURL"
 fi
 
-# Optional curl --resolve equivalent, e.g. rustproxy.lan:8443:10.10.10.20.
-# This lets the URL use the certificate DNS name while traffic goes to a fixed LAN IP.
+# Optional curl --resolve value, e.g. rustproxy.lan:8443:10.10.10.20.
 if [ -n "${RUSTPROXY_RESOLVE:-}" ]; then
     printf 'resolve = "%s"\n' "$RUSTPROXY_RESOLVE" >> "$TMP_CURL"
 fi