v0.35.1: performance, AGPL licensing and documentation overhaul

- Web Server reads static files inline; proxy middleware chain flattened
- About window with license summary and project links; AGPL-3.0-or-later
- Rewritten documentation: feature list, screenshots, performance guide
- Fix false spikes in per-Vhost request-rate charts

integrations/opnsense-acme/opnsense-rustproxy-cert-deploy.sh

@@ -1,8 +1,7 @@
 #!/bin/sh
 set -eu
 
-# Deploy an externally issued OPNsense/os-acme-client certificate to RustProxy 0.23.x.
-# Configuration is kept separately so the API token does not need to live in this script.
+# Deploy an OPNsense os-acme-client certificate to RustProxy; settings live in a separate file.
 
 CONFIG_FILE="${RUSTPROXY_ACME_CONFIG:-/usr/local/etc/rustproxy-acme.conf}"
 
@@ -62,10 +61,7 @@ KEY_PUB=$(
 "$OPENSSL" x509 -in "$CERT_FILE" -checkend 0 -noout >/dev/null 2>&1 \
     || fail "Certificate is already expired"
 
-# Always reconcile with RustProxy. The deploy endpoint is idempotent: an identical
-# RustProxy-owned generation is a server-side no-op, while a missing certificate id
-# is created and a changed manual certificate is rotated atomically. This avoids
-# trusting stale local state when the RustProxy configuration was changed separately.
+# The deploy endpoint is idempotent, so always reconcile instead of trusting local state.
 
 umask 077
 TMP_JSON=$(mktemp "${TMPDIR:-/tmp}/rustproxy-cert.XXXXXX") || fail "mktemp failed"
@@ -73,8 +69,7 @@ TMP_CURL=$(mktemp "${TMPDIR:-/tmp}/rustproxy-curl.XXXXXX") || { rm -f "$TMP_JSON
 TMP_RESPONSE=$(mktemp "${TMPDIR:-/tmp}/rustproxy-response.XXXXXX") || { rm -f "$TMP_JSON" "$TMP_CURL"; fail "mktemp failed"; }
 trap 'rm -f "$TMP_JSON" "$TMP_CURL" "$TMP_RESPONSE"' EXIT HUP INT TERM
 
-# PEM is line-oriented Base64 plus BEGIN/END markers. Escape it as a JSON string
-# without needing jq/python on OPNsense.
+# Escape PEM as a JSON string without jq/python.
 pem_json() {
     awk '{
         gsub(/\\/, "\\\\");
@@ -114,8 +109,7 @@ if [ -n "${RUSTPROXY_CACERT:-}" ]; then
     printf 'cacert = "%s"\n' "$RUSTPROXY_CACERT" >> "$TMP_CURL"
 fi
 
-# Optional curl --resolve equivalent, e.g. rustproxy.lan:8443:10.10.10.20.
-# This lets the URL use the certificate DNS name while traffic goes to a fixed LAN IP.
+# Optional curl --resolve value, e.g. rustproxy.lan:8443:10.10.10.20.
 if [ -n "${RUSTPROXY_RESOLVE:-}" ]; then
     printf 'resolve = "%s"\n' "$RUSTPROXY_RESOLVE" >> "$TMP_CURL"
 fi

integrations/routeros-oci-build/README.md

@@ -77,10 +77,10 @@ ENV_FILE=integrations/routeros-oci-build/.env \
   bash integrations/routeros-oci-build/build-routeros-oci.sh push
 ```
 
-With RustProxy version `0.25.0` and the defaults this publishes:
+For example, with RustProxy version `0.35.1` and the defaults this publishes:
 
 ```text
-zot.example.net/network/rustproxy:0.25.0
+zot.example.net/network/rustproxy:0.35.1
 zot.example.net/network/rustproxy:latest
 zot.example.net/network/rustproxy:routeros
 ```

integrations/routeros-oci-build/build-routeros-oci.sh

@@ -1,9 +1,7 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-# RustProxy multi-arch OCI builder for RouterOS.
-# Rust compilation runs on BUILDPLATFORM. Target binaries are cross-compiled,
-# so rustc/cargo do not run through QEMU for arm64 builds.
+# RustProxy multi-arch OCI builder for RouterOS (cross-compiled, no QEMU rustc).
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
@@ -74,8 +72,7 @@ VERSION="$(awk '
 ' "$PROJECT_ROOT/Cargo.toml")"
 [[ -n "$VERSION" ]] || { echo "Cannot determine package version from Cargo.toml" >&2; exit 1; }
 
-# Registry/image. Preferred format: REGISTRY + IMAGE_NAME.
-# OCI_IMAGE is kept as a compatible shorthand.
+# Image: REGISTRY + IMAGE_NAME (or OCI_IMAGE shorthand).
 if [[ -n "${OCI_IMAGE:-}" ]]; then
   IMAGE_REPO="${OCI_IMAGE%/}"
   REGISTRY="${OCI_REGISTRY:-${IMAGE_REPO%%/*}}"