v1.9.0 — web auth (C5) and Stage 1: the DB is the web layer's single source of truth Session auth on every route and the log websocket, fail-closed without FERRET_WEB_PASSWORD. Dashboard renders the real deletion queue from cleanup.db with live countdowns, the deletion audit trail, incomplete-scan banner, and honest labels for matched-this-scan vs in-queue. Kills the in-memory cleanup_results dual state, unifies CLEANUP_DB_PATH resolution, adds busy_timeout, exclusion match feedback, stall re-alerting, and versioned static assets with cache headers.