Updates 1

The session built:

Appointments page: a single list, newest first.
Block Time: edit and delete.
Customer CSV export: with barber notes excluded.
Guest-link regression test: a test that an appointment id alone is rejected, plus fixes to the stale docs.

It built the scheduler, job runner with live progress, backup and restore, and the health alerts. Its own report says a real delete-and-restore on throwaway Docker passed, but I haven’t repeated that. It also says real SMTP and large dumps were not exercised. The manager image needs rebuilding for the backups to work, because it now installs 7zip.

manager/src/proxy.ts

@@ -26,5 +26,9 @@ export const config = {
   // Runs on every page and API route except static assets — this app has
   // no public-facing content at all, unlike the main app's proxy.ts,
   // which has to carve out installation/customer-facing exceptions.
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+  //
+  // api/backups/upload is excluded deliberately: a proxy buffers (and
+  // truncates at 10 MB) every request body it sees, which would corrupt a
+  // large backup upload. That route verifies the session cookie itself.
+  matcher: ["/((?!_next/static|_next/image|favicon.ico|api/backups/upload).*)"],
 };