docs: Add GraphRAG entity extraction & knowledge graph proposal

* Add recommended variables section and config-linked secrets

Frontend:
- Split into Required (ANTHROPIC_API_KEY), Recommended (BRAVE_SEARCH, OPENAI),
  and Custom Variables sections
- New 'recommended' category

Convex:
- Added 'recommended' to secrets category union

Daemon:
- CONFIG_PATCHES map: known secrets that need gateway config changes
  (BRAVE_SEARCH_API_KEY → tools.web.search, TELEGRAM_BOT_TOKEN → channels+plugins)
- syncSecrets now applies config patches via WS before restarting gateway
- Config patches are deep-merged when multiple config-linked secrets are set

* Add docker-compose.dev.yml for local development with local images

* Fix docker-compose.dev.yml: add frontend service, use gateway/Dockerfile for local builds

* Fix frontend Dockerfile: include root deps and convex generated files

* Implement secret deletion: remove from .env and un-patch config

Convex:
- remove mutation now sets pendingDelete flag instead of deleting doc
- New internal query listPendingDeletesInternal + deleteInternal mutation
- New HTTP endpoints: GET /api/daemon/secrets/deletes, POST /api/daemon/secrets/deleted

Daemon:
- syncSecrets now polls for pending deletions after processing new secrets
- Removes deleted vars from .env file
- Applies CONFIG_REMOVALS patches for config-linked secrets (disables/clears)
- Confirms deletion to Convex (deletes the doc)
- Gateway restarts if any secrets were added or removed

* Fix delete: filter pendingDelete from list query, quote env values

- list query now excludes secrets with pendingDelete=true so they
  disappear from UI immediately on delete
- Env file values wrapped in single quotes to handle spaces

* Fix env file quoting: no wrapping, strip quotes on read

API keys don't have spaces. Previous single-quote escaping was
compounding on each read/write cycle. Now writes plain KEY=value
and strips any leftover quotes when reading.

* Wrap env values in double quotes with proper escaping

* Add delete button to recommended variables when set

添加 ensureModelInput() 防御性函数，确保 model.input 始终为数组，
防止上游 SDK 中 model.input.includes() 调用时因 undefined 而崩溃。

Fixes openclaw#32

Config changes (openclaw#33):
- Switch primary model to anthropic/claude-sonnet-4-5 (Claude Sonnet 4.6)
- Add model to deploy.sh post-deploy config, update fallback chain

Nginx changes (openclaw#32, openclaw#21):
- Increase /line/ proxy_read_timeout from 120s to 300s for complex agent responses

Docker build (openclaw#39):
- Enable OPENCLAW_INSTALL_BROWSER=1 build-arg to include Chromium in image

Deploy pipeline fix:
- deploy-vps.yml now actually applies nginx config (was only staging to .new)
- Added backup + rollback safety for nginx config changes
- Removed broken nginx path from deploy.sh (was referencing wrong VPS path)

Issues addressed: openclaw#9, openclaw#20, openclaw#21, openclaw#22, openclaw#23, openclaw#32, openclaw#33, openclaw#37, openclaw#39, openclaw#42, openclaw#45, openclaw#46

LINE OA users were getting 'access not configured' pairing prompt instead of
AI responses. The channels.line.dmPolicy was set to 'pairing', requiring each
user to be individually approved - impractical for a public-facing LINE OA.

Changes:
- config/openclaw.prod.json5: channels.line.dmPolicy -> 'open'
- docker/deploy.sh: add post-deploy step to set dmPolicy=open on VPS

Refs: openclaw#32

…E OA

- Add channels.line.dmPolicy=open to deploy.sh post-deploy config
- Update openclaw.prod.json5 template with open policy and KI-013 reference
- Fixes: LINE OA users blocked by pairing requirement (KI-013)

Refs: KI-013, openclaw#32

…dcast

Add email broadcast system and first waitlist update

…ntation

- PathOverviewPage: completion badge, CTA (Start/Continue/Review), offline cache
- PathDetailPage: module list with status badges, 'next up' highlight, offline cache
- App.tsx: add /paths/:pathId route
- i18n: DE/EN keys for all new strings (offline banner, badges, CTA, module status)
- Responsive layout (max-width 768px, works on iPhone 12 + iPad)
- Accessibility: role=progressbar, aria-labels, role=status/alert

…tool, outbound

- openclaw#12: Add Zod schema validation to credential store JSON.parse calls,
  returning empty/default store on validation failure instead of trusting
  untrusted data via type assertion.
- openclaw#26: Add Zod schema validation to browser-tool proxy responses,
  throwing descriptive error on malformed data instead of propagating it.
- openclaw#32: Add URL redaction (key, token, secret, api_key, apikey,
  access_token, auth, password, client_secret query params) and
  Authorization header redaction to outbound payload log formatting.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>