Release v1.1.0

docs/UI.md

@@ -20,7 +20,7 @@
 | Hash Route | Navigation Label | Purpose & Operational Features |
 | :--- | :--- | :--- |
 | `#dashboard` | **Dashboard** | System status, uptime, interface/peer counts, diagnostics health, and reconciliation status cards. |
-| `#interfaces` | **Interfaces** | List WireGuard interfaces, "+ Create Interface" modal, interface "Edit" action (with cryptographic key preservation), enable/disable toggle, and delete interface. |
+| `#interfaces` | **Interfaces** | List WireGuard interfaces with explicit **Role** badges (`Overlay` vs `Upstream`), "+ Create Interface" modal with tabbed **Standard Overlay** vs **Import Upstream VPN** (`.conf` parser & live preview), interface **Edit** action (preserves private/public key identity), **Restart** action (link teardown + re-sync), enable/disable toggle, delete action (protected against `wg0`), `Auto (Dynamic)` listen port display, and embedded read-only CLI console. |
 | `#peers` | **Peers** | Enrolled peer table with real-time handshakes, status filter, "+ Add Peer" modal with MTU profile resolution, client configuration export, and live SVG QR rendering. |
 | `#networks` | **Networks** | Subnet network ranges, CIDR masks, "+ Create Network" modal, and deletion. |
 | `#routes` | **Routes** | Routing table entries, gateway assignments, "+ Create Route" modal, and deletion. |
@@ -37,7 +37,7 @@
 
 ---
 
-## 3. Interactive Modals & Client Transport Profiles
+## 3. Interactive Modals & Upstream Workflows
 
 ### A. Client Profile & MTU Resolution Modal
 When enrolling a new peer (`#peers`), the modal automatically queries `/api/v1/client-profiles/resolve` based on selected Device (Android, iOS, Linux, Windows, macOS) and Connection (Mobile Cellular 4G/5G, Wi-Fi, Wired Ethernet) to determine optimal MTU (1280 vs 1360 vs 1420) and persistent keepalive (25s).
@@ -52,7 +52,17 @@ When opening the export modal for a peer, the UI automatically:
    - **Interactive Vector QR Code**: Inline SVG rendering for scanning directly with the official WireGuard mobile app.
    - **Downloadable `.conf` File**: Standard WireGuard client configuration file formatted for instant download or clipboard copy.
 
-### C. One-Time API Token Delivery Modal
+### C. Third-Party Upstream Import Modal (`#interfaces`)
+The "+ Create Interface" modal provides a dedicated **Import Upstream VPN** tab:
+1. Accepts interface name (e.g. `proton0`) and raw `.conf` content from third-party VPN providers (e.g. ProtonVPN).
+2. Provides a **Preview Configuration** button triggering `/api/v1/interfaces/upstreams/preview` to dry-run validate the configuration and display parsed tunnel addresses, DNS, MTU, listen port (showing `Auto (Dynamic)` when omitted), and provider peer details before writing to SQLite.
+3. Secret redaction: Private keys and PSKs are never echoed back in preview responses or displayed in cleartext in the UI.
+4. On submission, atomically saves desired state, provisions the kernel interface, and triggers reconciliation.
+
+### D. Embedded Read-Only CLI Console (`#interfaces`)
+Provides an in-browser interactive terminal to execute read-only operational and status commands (e.g., `nx9-wg interface upstream list`, `nx9-wg diagnostics all`). Enforces a strict server-side command allowlist and output secret sanitizer.
+
+### E. One-Time API Token Delivery Modal
 Generates a new API token, calculates its SHA-256 digest for SQLite storage, and presents the raw token string once in an interactive modal with a copy button.
 
 ---