v0.35.1: performance, AGPL licensing and documentation overhaul

- Web Server reads static files inline; proxy middleware chain flattened
- About window with license summary and project links; AGPL-3.0-or-later
- Rewritten documentation: feature list, screenshots, performance guide
- Fix false spikes in per-Vhost request-rate charts

scripts/deploy/deploy_runtime.py

@@ -211,9 +211,7 @@ def admin_health_endpoint(record: dict) -> tuple[str, bool, str]:
                 if isinstance(values, list):
                     allowed_hosts = [str(value).strip() for value in values if str(value).strip()]
     except (OSError, sqlite3.Error, ValueError, TypeError, json.JSONDecodeError):
-        # Old releases and damaged/uninitialized databases used the startup HTTP
-        # listener. The real startup diagnostics remain authoritative if this
-        # compatibility read cannot resolve persisted settings.
+        # Fall back to the startup listener for old or uninitialized databases.
         pass
 
     host, port = (raw[1:].split(']:') if raw.startswith('[') else raw.rsplit(':', 1))
@@ -234,9 +232,7 @@ def healthy(record: dict, version: str, attempts: int = 30) -> bool:
     host, port = (raw[1:].split(']:') if raw.startswith('[') else raw.rsplit(':', 1))
     for _ in range(attempts):
         if tls:
-            # Local deployment health is process identity/liveness, not PKI validation.
-            # The configured admin certificate may intentionally be self-signed or for
-            # a DNS name while we connect to the local socket.
+            # Local liveness probe only; the admin certificate may be self-signed.
             conn = http.client.HTTPSConnection(host, int(port), timeout=2, context=ssl._create_unverified_context())
         else:
             conn = http.client.HTTPConnection(host, int(port), timeout=2)
@@ -362,14 +358,12 @@ def update(record: dict, binary: Path, sha: str, start: bool, refresh_geoip: boo
         # Repair missing or stale installer-owned shell setup on upgrades.
         install_shell_path(prefix)
         check_shell_path(prefix)
-        # Repair stale root:root/0700 metadata before staging/network work and before
-        # stopping the currently healthy service.
+        # Repair stale ownership before stopping the running service.
         ensure_service_data_access(data, account)
         release, version = stage(binary, prefix, record['user'], sha)
         geoip_names: list[str] = []
         if refresh_geoip:
-            # Keep the same lock for checksum/download staging and publication. The
-            # runtime worker uses this file too, so manual upgrades cannot race it.
+            # Shared lock with the runtime worker prevents concurrent upgrades.
             geoip_lock_fd = acquire_geoip_update_lock(data, account.pw_uid, account.pw_gid)
             geoip_stage, geoip_names = prepare_geoip_update(data, prefix)
         active = subprocess.run(['systemctl', 'is-active', '--quiet', SERVICE], check=False, stdout=subprocess.DEVNULL).returncode == 0