OpenConstructionERP Files

Two security fixes from responsibly disclosed reports. The in-app upgrade endpoint used to run with no authentication, so anyone who could reach the API on a quickstart or an exposed install could force a package reinstall or a downgrade, and it now requires an authenticated admin and is rejected before any pip process starts. Self-hosted AI provider URLs for Ollama and vLLM were fetched server-side without validation, so a saved base URL could point the server at an internal host or the cloud metadata endpoint, and they are now checked when saved and again after DNS resolution at the single point every AI call funnels through. Loopback and private addresses stay reachable so a local runtime still works out of the box, while link-local and cloud metadata are always blocked, and an operator can set an allowlist to restrict endpoints to a known set.

The PDF takeoff viewer gets three fixes reported from the field. The scale-calibrate button showed its full tooltip text as its label and now reads a short "Calibrate", with the longer description kept in the tooltip. Starting a two-click scale calibration no longer leaves the draw tools painting underneath it: the rubber-band, the snap ring and the measurement readout are hidden for the pick and cleared afterwards, so nothing is left frozen on the canvas. The toolbar top row no longer wraps to a second line when the side panels are open, because the button labels now collapse to icons by the toolbar's own width instead of the viewport width.

On the cases, every case scene is drawn in the accent color of its category so the cases hub and the dashboard preview read as a colored set, the case page now leads with the case title and tags above the process with a compact full-width row of step cards, and the dashboard "learn by example" block previews ten cases per row instead of eight.

Full Changelog: https://github.com/datadrivenconstruction/OpenConstructionERP/compare/v11.12.0...v11.13.0