Bug bash fixes: special-file reads, per-client lockout, prefs validation, security headers, kernel-thread guard, login feedback, error text; plus journal-quiet sudoers + journal groups, upload overwrite guard, machines pattern, dnf freshness, cron/services speed, clean version

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/hamlab.service

@@ -6,6 +6,8 @@ After=network.target
 Type=simple
 User=@USER@
 Group=@GROUP@
+# read the system journal without sudo (keeps the daemon's own log clean)
+SupplementaryGroups=systemd-journal adm
 WorkingDirectory=@HOME@
 Environment=HAMLAB_CONFIG=@HOME@/apps/hamlab/config.json
 ExecStart=@PREFIX@/hamlab serve

deploy/install.sh

@@ -25,6 +25,20 @@ for alt in bin/hamlab-linux-*; do
 done
 sudo install -m 0644 "$unit" /etc/systemd/system/hamlab.service
 rm -f "$unit"
+# Keep the daemon's read-only sudo polling (SMART, UPS, journal) out of the journal: with
+# 250 ms refresh rates the sudo session lines would otherwise dominate the log.
+quiet=$(mktemp)
+cat > "$quiet" <<'SUDOERS'
+# Ham Lab: don't log the daemon's read-only polling commands (installed by deploy/install.sh)
+Cmnd_Alias HAMLAB_QUIET = /usr/sbin/smartctl, /usr/bin/smartctl, /usr/sbin/pwrstat, /usr/bin/journalctl, /usr/bin/tail, /usr/bin/cat, /usr/bin/ls, /usr/bin/crontab
+Defaults!HAMLAB_QUIET !syslog, !pam_session, !pam_setcred
+SUDOERS
+if sudo visudo -cf "$quiet" >/dev/null 2>&1; then
+  sudo install -m 0440 -o root -g root "$quiet" /etc/sudoers.d/hamlab-quiet
+else
+  echo "warning: sudoers snippet failed validation; skipped" >&2
+fi
+rm -f "$quiet"
 sudo systemctl daemon-reload
 sudo systemctl enable hamlab.service >/dev/null
 if [ ! -f "$HOME_DIR/apps/hamlab/config.json" ]; then