v1.0.0: working read-only Unraid security auditor

.github/workflows/test.yml

@@ -0,0 +1,21 @@
+name: Test v1 scanner
+
+on:
+  push:
+    branches: [main, v1-base-model]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate shell syntax
+        run: |
+          bash -n src/scripts/security-check.sh
+          bash -n tests/run-tests.sh
+      - name: Run fixture tests
+        run: bash tests/run-tests.sh

CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 1.0.0 - 2026-09-04
+
+Initial working base model.
+
+- Replaced the placeholder Vue UI with a traditional Unraid WebGUI `.page` implementation.
+- Added a read-only scanner that emits structured JSON.
+- Added checks for root account protection, Telnet, FTP, SSH authentication, public SMB shares, flash-share exposure, public NFS exports, WebGUI TLS, common management listeners, and installed Unraid version.
+- Explicitly distinguishes local listeners from proven Internet exposure.
+- Added fixture-based tests for insecure and secure configurations.
+- Reworked the plugin installer so runtime source is installed from an immutable pinned Git commit rather than executing whatever happens to be on `main` at install time.