Better WebConsole

Added

• Added a fallback /api/stats polling path in the web UI so dashboard data can recover when WebSocket stats are delayed or unavailable.
• Added tests for absolute session lifetime expiry behavior.
• Persistent TPS/RAM/CPU/player history storage in server-stats-history.tsv.
• New authenticated endpoint: GET /api/stats/history.
• Dashboard range selector for 1h, 6h, 24h, and all.
• Offline player roster, offline profile lookup, and last-seen display.
• LuckPerms rank/prefix display via soft dependency.
• Config options for stats history retention, API max points, and write interval.

Changed

• Added an absolute web session lifetime limit in addition to the idle timeout.
• Added security.session-max-lifetime-minutes to config.yml and README examples.
• Set the session cookie Max-Age from the absolute session lifetime so browser cookies and server-side sliding sessions stay consistent.
• Matched unknown-user dummy bcrypt verification cost to real password hashes.
• Updated /bwc reload messaging and docs to mention that session max lifetime changes require a server restart.
• Dashboard charts now render persisted/downsampled history.
• Player models support online/offline state, rank metadata, and activity counters.
• Paper 26.1 grouped artifact renamed from 26.1.X to 26.X.
• Project version bumped to 2.4.8.

Fixed

• Restored normal login form submit behavior for browser autofill, password managers and automation.
• Cleared the password field after a successful web login.
• Warned server owners when the web panel listens on all interfaces without secure cookies or an IP whitelist.
• Ensured loaded persisted sessions are rejected when they exceed the absolute lifetime, even if their idle timeout has not expired.

Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.6...2.4.8