Numbers come from a one-shot postconf -h at panel start so a manual override is visible after restart, without inventing an attempt count.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lay out view, auth, validate, and handlers under internal/web while keeping
the cmd/panel API unchanged; update roadmap and changelog for web-split closure.
Co-authored-by: Cursor <cursoragent@cursor.com>