feat: hide reset button for remote connections

Instead of showing an error when remote users try to reset,
the button is now hidden entirely for Cloudflare connections.

- Button starts hidden by default
- Server injects __IS_REMOTE__ flag based on Cloudflare headers
- JS shows button only for local connections

Author: HAL

webstatuspi/_dashboard/_js_core.py

@@ -648,6 +648,10 @@
         }
 
         // Button event listeners (CSP-compliant, no inline handlers)
+        // Show reset button only for local connections (hidden by default)
+        if (!window.__IS_REMOTE__) {
+            document.getElementById('resetDataBtn').hidden = false;
+        }
         document.getElementById('resetDataBtn').addEventListener('click', showResetModal);
         document.getElementById('historyModalClose').addEventListener('click', closeModal);
         document.getElementById('resetModalClose').addEventListener('click', cancelReset);

webstatuspi/_dashboard/dashboard.html

@@ -44,8 +44,9 @@ <h1><span class="logo-bracket">&lt;</span><span class="logo-text">WebStatusπ</s
             <span class="updated-time" id="updatedTime" role="status" aria-live="polite">// INITIALIZING...</span>
             <button class="install-button" id="installBtn" hidden
                 aria-label="Install WebStatusπ app" type="button">// INSTALL APP</button>
-            <button class="reset-button" id="resetDataBtn"
+            <button class="reset-button" id="resetDataBtn" hidden
                 aria-label="Reset all monitoring data" type="button">// RESET DATA</button>
+            <script nonce="__CSP_NONCE__">window.__IS_REMOTE__=__IS_REMOTE__;</script>
         </div>
     </nav>
     <main id="cardsContainer" role="main" aria-label="Service status cards">

webstatuspi/api.py

@@ -807,6 +807,9 @@ def _handle_dashboard(self) -> None:
         # get_dashboard() supports hot-reload: detects template file changes
         html = get_dashboard().replace(CSP_NONCE_PLACEHOLDER, nonce)
         html = html.replace("__INITIAL_DATA__", initial_data)
+        # Hide reset button for remote (Cloudflare) connections
+        is_remote = "true" if self._is_cloudflare_request() else "false"
+        html = html.replace("__IS_REMOTE__", is_remote)
         body = html.encode("utf-8")
 
         self._send_html_bytes(200, body, nonce)