[Starosdev]

Summary

WP-G0 (required frontend changes for 2.0.0). The UI now matches the 2.0 backend: the login page explains where the auth token comes from, the removed report_pdf_path setting is gone, and rejected notification URLs show the server's error instead of failing silently.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• CI/CD or infrastructure change

Related Issues

Related to #965 and #973.

Changes Made

• Login page: help text naming /opt/scrutiny/config/.auth-token and the docker exec <container> cat /opt/scrutiny/config/.auth-token command for omnibus, SCRUTINY_WEB_AUTH_TOKEN for hub/spoke, and a link to docs/AUTH.md. The error box has role="alert" and the token show/hide button has an aria-label. No guard or interceptor change was needed: AuthGuard redirects to /login when auth is enabled, and the 401 interceptor clears the token and routes to /login with returnUrl.
• Removed report_pdf_path from app.config.ts, the dashboard settings component (field, load, save), and the PDF Save Directory input. report_pdf_enabled is unchanged.
• Notification URLs: add and test failures show the server message (error.error, else error.errors[0], else a generic message) in a role="alert" live region above the URL table.
• NVMe status reasons: no change needed; detail.component.html already renders attribute.status_reason, which the backend now fills for critical_warning.

Testing

• I have tested this locally
• I have added/updated tests that prove my fix/feature works
• All existing tests pass

npm ci; npm run lint (0 errors; 3 pre-existing prettier warnings in untouched files); npm run test:icons; npm run test:theme; ng test --watch=false --browsers=ChromeHeadless (TOTAL: 248 SUCCESS); npm run build:prod (bundle generation complete). New specs cover the login guidance and the add/test 400 and fallback error display. No manual browser pass.

Checklist

• My code follows the project's code style
• I have performed a self-review of my code
• I have commented my code where necessary (particularly complex areas)
• I have updated the documentation if needed
• My changes generate no new warnings

Notes

• login.component.html was not prettier-clean on beta; the pre-commit hook reformatted the whole file, so its diff is larger than the content change.
• Not done: a warning for already-stored unsafe notification rows. GET /api/settings/notify-urls has no skipped or unsafe flag, and matching script:// in the client would duplicate backend rules. Tracked in [2.0.0] Phase 1 review follow-ups and frontend changes #973.

Review: not required (UI-only change on the beta integration branch; an independent read-only review is being run per release coordination)