release: 1.3.7 — clipboard fix, diagnostic dual-probe, HWID rotation

Quality-of-life follow-up to v1.3.6. Headline is a clipboard helper
that makes every 'Copy' button in the UI actually work on plain-HTTP
LAN origins — they used to silently fail because navigator.clipboard
is gated behind window.isSecureContext.

Highlights:
- New lib/clipboard.ts with execCommand fallback for insecure HTTP
- Internet check split into 'direct' (SO_MARK=0xff bypass) + 'via VPN'
- Per-subscription rotate_hwid toggle for panels throttling stable HWIDs
- RoutingRule.action remap on legacy-dup collapse (missed in 1.3.6)
- CodeQL hardening: literal-allowlist subprocess + log replace sanitiser
- Frontend bundle split: index chunk 354 KB → 161 KB gzipped

8 commits since v1.3.7-rc. 13 new tests; backend full suite + frontend
25/25 green. One Alembic migration (016, backward-compatible default).

Safe to upgrade from any 1.3.x. Migration applied automatically by
install.sh; hot-update requires 'alembic upgrade head' before restart.

Author: DaveBugg

backend/alembic/versions/016_add_subscription_rotate_hwid.py

@@ -34,6 +34,12 @@ def upgrade() -> None:
                 server_default=sa.false(),
             )
         )
+    # SQLite's batch_alter_table sometimes leaves the column NULL for
+    # pre-existing rows even with `server_default=false`. Belt-and-
+    # braces backfill keeps the column consistent (model treats NULL
+    # as False at the Python level anyway, but cleaner DB state means
+    # the UI never sees an indeterminate checkbox).
+    op.execute("UPDATE subscription SET rotate_hwid = 0 WHERE rotate_hwid IS NULL")
 
 
 def downgrade() -> None:

backend/app/config.py

@@ -5,7 +5,7 @@
 # OpenAPI metadata, `/health` response, and `/system/status` so the
 # frontend can display it next to the xray version. Bump this on each
 # release — frontend keeps its own version in `frontend/package.json`.
-APP_VERSION = "1.3.6"
+APP_VERSION = "1.3.7"
 
 
 class Settings(BaseSettings):

frontend/package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "pitun-frontend",
   "private": true,
-  "version": "1.3.6",
+  "version": "1.3.7",
   "license": "BSD-3-Clause",
   "type": "module",
   "scripts": {