V0.1.1 release, close to actual release. Bug & security fixes/improvements.

docs/API.md

@@ -75,7 +75,7 @@
   - `410 Gone` — Content has reached its maximum view count.
   - `416 Range Not Satisfiable` — Invalid `Range` header.
 - **Notes:**
-  - The server increments the view counter on successful full-file responses. Range requests and `If-None-Match` (ETag) matches do **not** increment the counter.
+  - The server increments the view counter on successful full-file responses. Range requests, `If-None-Match` (ETag) matches, and HEAD requests do **not** increment the counter.
   - If the incremented view count reaches `max_views`, the server may delete content files (depending on `keep_content` config) and mark the content as `Deleted`, returning `410 Gone`.
   - `Accept-Ranges: bytes` is included for `video/*` and `audio/*` MIME types.
   - Cache-Control is `private, max-age=60` for unprotected content and `private, no-store, max-age=0` for password-protected content.
@@ -105,6 +105,26 @@
 
 ---
 
+### POST /api/content/:cxid/report
+- **Description:** Report content for review. Creates a report record and forwards a notification to all configured review groups via the Telegram Bot API.
+- **Auth:** None
+- **Path params:**
+  - `cxid` — Content ID string.
+- **Body:** JSON object:
+  ```json
+  {
+    "reason": "string"
+  }
+  ```
+- **Response formats:**
+  - `204 No Content` — Report accepted.
+  - `404 Not Found` — Content does not exist or has been deleted/blacklisted.
+- **Notes:**
+  - The report is recorded with `reporter_user_id = 0` to indicate a web-based report.
+  - Rate limiting is covered by the general API governor.
+
+---
+
 ### POST /api/content/:cxid/verify-password
 - **Description:** Explicitly verify a password for password-protected content and receive an authentication cookie.
 - **Auth:** None (this is the endpoint used to *obtain* auth).
@@ -135,6 +155,11 @@ The server allows cross-origin requests from its configured `base_url` and commo
 - General API routes (`/api/health`, `/api/content/...`) share a per-IP rate limit configured by `requests_per_minute` and `burst`.
 - `POST /api/content/:cxid/verify-password` has its own rate limit with a burst of 3 and a separate `password_attempts_per_minute` setting.
 
+### Password Flow
+- The `sc` query parameter is checked on both the metadata endpoint (`GET /api/content/:cxid`) and the file endpoints (`GET /api/content/:cxid/file/:file_idx`, `GET /api/content/:cxid/file/:file_idx/raw`). When valid, the server sets an HMAC-signed `cgcx_pw` cookie on the response.
+- Passwords can also be provided via the `cgcx_pw` cookie.
+- For programmatic verification, use `POST /api/content/:cxid/verify-password`.
+
 ### Fallback / Static Assets
 - `/assets/*` — Serves static files from `frontend/dist/assets`.
 - All other non-`/api` paths — Serves `frontend/dist/index.html` (SPA fallback).