2 Commits

Author	SHA1	Message	Date
shinchan-zhai	f26a69d222	security: configurable CORS origins, limit sentinel response body ... - Add CORS_ALLOWED_ORIGINS config (comma-separated origins, default allow-all) - CORS middleware now validates Origin header against allowlist - Add io.LimitReader to sentinel.go (was unbounded, now 256KB) - Include previous: agent chat auth middleware + frontend token header	2026-03-23 09:53:49 +08:00
shinchan-zhai	ff9928c24f	feat: unified NOFXi — one system, one port, one UI ... Key changes: - Agent API routes (/api/agent/*) registered directly on NOFX's :8080 server - No more separate :8900 port — everything on :8080 - AgentChatPage.tsx added to React frontend - Agent tab (🤖 Agent) added to navigation bar, set as DEFAULT page - Branding: NOFX → NOFXi everywhere (title, header, branding.ts, i18n) - Default landing page is now Agent chat, not competition This is THE change: there is no more 'NOFX' vs 'NOFXi'. Users open localhost:8080, they see NOFXi. Agent chat is the first thing they see. All other pages (Traders, Dashboard, Strategy, Data) are still there. One binary. One port. One product. NOFXi.	2026-03-23 00:44:10 +08:00