- tighten frontend permission gating for docker registries, SSL certificate actions, proxy toggles, and nginx template access - allow read-only nginx template preview for viewers and keep editors on the full editor route - move pinned dashboard nodes and proxy hosts directly under the top stats cards