Opens Veola up to more users (Parodia's Authentik) and makes Apify spend
visible to everyone.
- Auth: Traefik forward-auth (trust X-Authentik-* headers only from
trusted_proxies CIDRs, keyed by email, role synced from admin_group),
keeping local password login as break-glass. New [auth] config,
CaptureDirectIP + ForwardAuth middleware, deploy/authentik-forward-auth.md.
- Budget: count every Apify run (apify_api_usage table) and show
calls + estimated cost to all users on the dashboard, with an optional
monthly-budget bar. New [budget] config + settings.
- Email: Resend client for opt-in deal alerts and a weekly digest
(Mon 09:00). Per-user email + toggles on Settings. New [resend] config.
- Defaults: new items default to a 12-hour poll interval to cut spend.
users table gains email/auth_source/email-pref columns (migrated in place).
go build/vet/test green; boots and migrates cleanly.
eBay marketplaces are now polled through eBay's official Buy > Browse API (client-credentials OAuth2) instead of an Apify scraper actor; Apify still handles Yahoo JP and Mercari. Browse API calls are tracked per day in a new ebay_api_usage table and capped (default 5000, configurable) on eBay's Pacific-time reset clock, so polling halts before the limit is hit. Credentials live in config.toml [ebay] and are overridable via /settings, which also surfaces the day's running call count.
Also carries the server.secure_cookies config plumbing (field, accessor, example) consumed by the following commit.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
