- sso-gate.js: add GET /api/v1/auth/login-page?service= route; auto-login HTML for chat/plex/jellyfin/emby now served from code instead of inline Caddyfile respond blobs. Fix merge() try-block syntax error (was missing closing } before catch, breaking Jellyfin/Emby localStorage merge). - middleware.js: add /api/v1/auth/login-page to PUBLIC_ROUTES. - CLAUDE.md: complete rewrite — was describing the old Windows-local C:/caddy/ layout; now accurately describes DNS2 production (paths, container, caddy-apply workflow, SSO architecture, common mistakes). - .gitignore: cover runtime JSON/log/cert files that were sitting untracked in dev root (audit-log, backup-history, credentials, health-history, etc.), plus generated-certs/, pki/, assets/. - Remove tracked dev-root noise: comprehensive-test.js, license-keygen.js, test-security-fixes.js (scripts that don't belong at repo root). - Remove stale routes/openclaw.js (leftover from old monolithic structure). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>