Uses /api/v1/auth/login; requires is_admin. Token kept in sessionStorage only.
One tunnel per home gateway. "Report" opens the printable audit report for that tunnel: sessions, device IP/IMEI/MAC, first ten sites visited, audit trail. "events" lists what the gateway itself reported — including anything it queued while ODIVORA was unreachable (unverified).
IP is observed by the server; IMEI/MAC are self-reported by the mobile app and unverified.
Prometheus: /metrics/prometheus · rules in prometheus/alert_rules.yml