Publish form now uses a single dashed drop area for .html uploads
(click-to-browse fallback included). Removes the paste-HTML textarea
since real artifacts always come from a file. Server-side multipart
handling is unchanged; the `file` form field already took precedence.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When SSO_GATEWAY_SECRET is set and an incoming request carries both
X-Artifacto-Gateway (matching the secret) and X-Authentik-Username, the
admin middleware mints a session automatically so Authentik-authenticated
users skip the password form. Missing or wrong gateway header falls back
to the password-login flow, so peers that can reach the container
directly (bypassing the reverse proxy) cannot spoof Authentik identities.
Self-hosted HTML artifact publisher. Single Go binary, SQLite metadata,
HTML on disk. Features: password-protected artifacts, per-artifact expiration,
admin dashboard with view metrics (privacy-preserving daily-salt visitor hash,
sparklines, 30-day SVG chart, top referrers), rate-limited unlock endpoint.
Packaged as a Docker image (two-stage, CGO_ENABLED=0, pure-Go SQLite).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
