internal/

Package apparmor exposes the shipped AppArmor profile as an embedded byte slice so the `by admin install-apparmor` CLI subcommand can drop it on operators' disks without requiring network access.

Package appname provides app name validation shared by the API and UI packages.

Package boardstorage hosts the control-plane side of the board-storage feature (see #283/#284/#285): startup SQL, per-user PG role provisioning, vault static-role registration.

Package dockerauth resolves Docker registry credentials from the user's ~/.docker/config.json so that Go SDK callers can authenticate image pulls.

Package errorlog captures recent WARN/ERROR slog records into a bounded in-memory ring buffer for display in the admin UI.

Package orchestrator manages rolling updates from inside the running server.

Package seccomp exposes the committed outer-container seccomp profile as an embedded byte slice so the `by admin install-seccomp` CLI subcommand can drop it on operators' disks without requiring network access.

Package units provides parsers for human-readable input units (e.g.

Package update provides shared logic for checking GitHub releases and determining whether the running build is older than the latest publicly available version.