feat: open full web CLI access and add panel redirect flow

docs/custom-cli.md

@@ -82,93 +82,15 @@ Legacy dotted aliases are also accepted:
 - `get battery.reporting`: shows whether board battery reporting is enabled. Support is board-dependent.
 - `set battery.reporting on|off`: enables or disables battery voltage reporting on supported boards. This is currently useful for Heltec V3 boards where USB-only power can produce misleading battery readings. If your board needs this too, open an issue and support can be added board-by-board.
 
-## Web Panel Allowlisted Commands
+## Web Panel CLI Access
 
-When the repeater web panel is enabled, it only allows a limited command set.
+When the repeater web panel is enabled and you are authenticated, the browser CLI panel can run the same CLI commands accepted by the repeater.
 
-That allowlist currently includes:
+Notes:
 
-- `clock`
-- `region default`
-- `region default <name>`
-- `region default <null>`
-- `get mqtt.status`
-- `get web`
-- `get web.status`
-- `get web.stats.status`
-- `advert`
-- `reboot`
-- `start ota`
-- `memory`
-- `stats-core`
-- `stats-radio`
-- `stats-packets`
-- `get wifi.status`
-- `get wifi.powersaving`
-- `set wifi.ssid <ssid>`
-- `set wifi.pwd <password>`
-- `set wifi.powersaving on|off`
-- `get mqtt.iata`
-- `set mqtt.iata <code>`
-- `get mqtt.owner`
-- `set mqtt.owner <64-hex-char-public-key>`
-- `get mqtt.email`
-- `set mqtt.email <email>`
-- `get mqtt.packets`
-- `set mqtt.packets on|off`
-- `get mqtt.raw`
-- `set mqtt.raw on|off`
-- `get mqtt.statuscfg`
-- `set mqtt.status on|off`
-- `get mqtt.tx`
-- `set mqtt.tx on|off`
-- `get mqtt.eastmesh-au`
-- `set mqtt.eastmesh-au on|off`
-- `get mqtt.eastmesh.au`
-- `set mqtt.eastmesh.au on|off`
-- `get mqtt.letsmesh-eu`
-- `set mqtt.letsmesh-eu on|off`
-- `get mqtt.letsmesh.eu`
-- `set mqtt.letsmesh.eu on|off`
-- `get mqtt.letsmesh-us`
-- `set mqtt.letsmesh-us on|off`
-- `get mqtt.letsmesh.us`
-- `set mqtt.letsmesh.us on|off`
-- `set web on|off`
-- `set.web on|off`
-- `set web.stats on|off`
-- `set.web.stats on|off`
-- `get name`
-- `set name <device-name>`
-- `get lat`
-- `set lat <latitude>`
-- `get lon`
-- `set lon <longitude>`
-- `get radio`
-- `set radio <freq> <bw> <sf> <cr>`
-- `get prv.key`
-- `get guest.password`
-- `password <admin-password>`
-- `set guest.password <password>`
-- `set prv.key <64-hex-char-private-key>`
-- `get role`
-- `get public.key`
-- `get advert.interval`
-- `set advert.interval <minutes>`
-- `get agc.reset.interval`
-- `set agc.reset.interval <seconds>`
-- `get flood.advert.interval`
-- `set flood.advert.interval <hours>`
-- `get repeat`
-- `set repeat on|off`
-- `get flood.max`
-- `set flood.max <count>`
-- `get path.hash.mode`
-- `set path.hash.mode <mode>`
-- `get owner.info`
-- `set owner.info <text>`
-- `time <iso-or-epoch>`
-- `time.force <iso-or-epoch>`
+- the panel still uses the repeater admin password for access
+- commands run with the same care as if you typed them into the repeater CLI directly
+- this is intended for local admin use on a trusted network
 
 ## Companion WiFi Rescue Commands
 

docs/web-panel.md

@@ -13,7 +13,7 @@ It gives you:
 - a password-gated local admin page at `/app`
 - a dedicated stats and trends page at `/stats`
 - quick `get` commands for common repeater and MQTT checks
-- a terminal-style CLI panel for allowlisted commands
+- a terminal-style CLI panel for full repeater CLI access
 - editable repeater settings
 - editable MQTT settings
 - a historical stats view with trends, neighbours, and recent events
@@ -71,7 +71,7 @@ Example:
 - the panel uses the same admin password as the repeater CLI
 - the connection is HTTPS, but the certificate is self-signed
 - browsers will warn the first time you connect
-- the panel only exposes an allowlisted subset of CLI commands
+- the panel exposes the repeater CLI after login
 
 This is intended for local admin use on a trusted network, not for open internet exposure.
 
@@ -134,13 +134,13 @@ These are useful for quick checks without typing into the CLI field.
 
 ## Run CLI Command
 
-This is a small terminal for allowlisted commands.
+This is a small terminal for the repeater CLI.
 
 - press `Enter` to run the command
 - command history is shown in the terminal box below
 - save buttons elsewhere in the page also show the generated command and the reply here
 - `clock` is available here if you want to check the repeater's current board time
-- the full current allowlist is documented in `docs/custom-cli.md` under `Web Panel Allowlisted Commands`
+- authenticated sessions can run the same CLI commands accepted by the repeater
 
 This makes it easy to see exactly what the panel sent to the repeater.
 
@@ -310,9 +310,9 @@ Check:
 
 For fixed installations where MQTT uptime matters more than browser access, use the panel briefly and then disable it again.
 
-### A command says it is not allowlisted
+### HTTP opens instead of HTTPS
 
-The panel intentionally limits what can be run from the browser. Use the serial CLI for commands outside the web allowlist. `clock` is included, but most maintenance and debug commands are still serial-only.
+The repeater now redirects plain `http://` requests to the local `https://` panel URL. If the browser still shows a connection problem after redirecting, open `https://<repeater-ip>/` directly and accept the self-signed certificate warning first.
 
 ### Stats or settings do not refresh