- Secured node-related endpoints with group-based access control.
- Fixed user preference merging to preserve node attachments.
- Restricted modification and deletion of system skills.
- Hidden administrative node controls for non-admin users.
- Fixed WebSocket connectivity and permission checks for node mesh.
- Filtered node visibility in profile and swarm control to granted nodes only.

- Removed all temporary root Python test scripts
- Secured remote_deploy.sh credentials using environment variables
- Added data/audio payloads directory to .gitignore
- Added automatic DB migration script (migrate.py) via uvicorn lifespan
- Applied major refactors to UI Voice Chat, Session handling, and unified React API configs
- Updated models and dependencies natively syncing with Nginx proxy features

- Show model name under each provider button for all users (ProfilePage)
- Admin Settings: upgraded 'Register New Instance' panel with 4 fields:
  provider type, label suffix (with model-name hint), pre-set model
  dropdown, and 'Inherit API Key From' for same-type instance cloning
- Fix API key inheritance: use _clone_from marker instead of copying
  masked key; backend resolves real key from DB before saving
- Lock cloned-key instances: API key field is greyed out with lock icon
  and 'Inherited from <source>' display; Unlink button breaks the link
- Provider card header: show configured model name instead of
  'User Override / System Provided' labels
- ProfilePage: remove confusing 'Do Extra Work' override panel entirely;
  ServiceSelect is now a clean provider selector with no hidden admin UI
- SettingsPage: remove 'User Override' / 'System Provided' badge