PR

• Have you followed the contributing guidelines?
• Have you explained what your changes do, and why they add value?

Please note: we will close your PR without comment if you do not check the boxes above and provide ALL requested information.

---

---

Summary by cubic

Merges stage-apps into stage, combining the Ever Async integration, the employee edit and HR dashboard redesigns, shared table-page styling, and a broad set of security hardening fixes.

New features

• Adds the organization-scoped Ever Async connector as a backend plugin (integration-ever-async) and Angular UI plugin wired into the API, webapp, worker builds, and workspace plugin registry.
• Rebuilds the employee edit tabs as shared flat panels with a common employee-tab-panel language, removing the borrowed organization stylesheet and viewport-arithmetic heights.
• Redesigns the HR dashboard around identity, four KPI tiles, and breakdown/statistics panels, with charts sharing one option set, theme tokens, and an HTML legend.

Security & ops

• Fixes authorization based on stale JWT claims: account status and roles are re-resolved per request, so deactivation and demotion take effect immediately.
• Makes login throttling unforgeable by trusting proxy headers only behind Cloudflare, and adds per-account failure counting; shipped nginx configs now own the forwarding headers.
• Refuses to seed default credentials in production and stops the web build baking published passwords into the bundle; deployment secrets are no longer committed.
• Closes IDOR and mass-assignment paths (time-log conflict, invite accept/contact), enforces sensitive-relation permissions on CRUD and hand-rolled queries, redacts secrets in export archives, and isolates export/import job state.
• Verifies the GitHub webhook HMAC, guards AI-provider base URLs against SSRF, and resolves Upwork credentials server-side only.
• CI workflows now skip jobs for pull requests from forks.