Document dated PROGRESS updates and reorder log by date

AGENTS.md

@@ -2,6 +2,7 @@
 
 - Assume full access to network, shell commands, and all files under the current working directory.
 - On session start, open `PROGRESS.md` to refresh project status.
+- When updating `PROGRESS.md`, add a date marker (e.g., `## YYYY-MM-DD — …`) and list changes under it until the date changes; keep earlier entries intact and sorted by date.
 - After that, scan the repo structure (e.g., list key dirs/files) to regain context before continuing work.
 - After finishing each new feature, create a git commit with a sensible message and update documentation to reflect the changes.
 

PROGRESS.md

@@ -1,4 +1,4 @@
-# Lomavuokraus infra progress (Nov 22)
+## 2025-11-22 — Lomavuokraus infra progress
 
 - Repo initialized with Next.js App Router scaffold:
   - Health endpoint: `app/api/health/route.ts`
@@ -25,7 +25,7 @@
 - `AUTH_SECRET` removed from `deploy/env.sh`; export it in shell (or via `scripts/load-secrets.sh`) before deploy.
   - `creds/` and `k3s.yaml` are git-ignored; contains joker DYNDNS creds and registry auth.
 
-# Lomavuokraus app progress (Nov 24)
+## 2025-11-24 — Lomavuokraus app progress
 - New testing DB (`lomavuokraus_testing`) holds the previous staging/prod data; the main `lomavuokraus` DB was recreated clean with only the seeded admin user. Migration history was copied, and a schema snapshot lives at `docs/db-schema.sql`.
 - Testing environment wiring added: dedicated namespace (`lomavuokraus-test`), deploy wrapper (`deploy/deploy-test.sh`), API host support, and a DNS updater for `test.lomavuokraus.fi` / `apitest.lomavuokraus.fi`.
 - Access control tightened: middleware now gates admin routes, admin-only pages check session/role, API handlers return proper 401/403, and listing removal is limited to owners/admins (no more moderator overrides).
@@ -40,7 +40,7 @@
 - Latest images built/pushed: `registry.halla-aho.net/thalla/lomavuokraus-web:1763993882` (approvals badge + FI/EN localization) and `:1763994382` (profile edit). Staging/prod rolled out.
 - Security: `npm audit --audit-level=high` runs in build (warnings only). Trivy scan run; remaining CVEs mostly in tooling (cross-spawn, glob) and base OS Debian 12.10. Further reduction would require eslint-config-next 16.x and base image updates when available.
 
-# Recent changes (Nov 24, later)
+## 2025-11-24 — Recent changes
 - Public browse/search page with map, address filters, and EV charging amenity; listings now store street address and geocoordinates.
 - Amenities expanded: electric vehicle charging (free/paid) and air conditioning; cover image selectable per listing and used in cards.
 - Home page shows a rolling feed of latest listings; navbar + CTA link to browse.
@@ -69,8 +69,8 @@
 - Centralized logging stack scaffolded (Loki + Promtail + Grafana) with Helm values and install script; Grafana ingress defaults to `logs.lomavuokraus.fi`.
 - Logging: Loki+Promtail+Grafana deployed to `logging` namespace; DNS updated for `logs.lomavuokraus.fi`; Grafana admin password reset due to PVC-stored credentials overriding the secret.
 - Mermaid docs fixed: all sequence diagrams declare their participants and avoid “->” inside message text; the listing creation diagram message was rewritten to prevent parse errors. Use mermaid.live or browser console to debug future syntax issues (errors flag the offending line/column).
-- New amenities added: kitchen, dishwasher, washing machine, barbecue; API/UI/i18n updated and seeds randomized to populate missing prices/amenities. Prisma migration `20250210_more_amenities` applied to shared DB; registry pull secret added to k8s Deployment to avoid image pull errors in prod.
-- Added About and Pricing pages (FI/EN), moved highlights/runtime config to About, and linked footer navigation.
+
+## 2025-11-27 — Availability & filters
 - Availability calendars: listings can store iCal URLs, merged into a combined availability calendar on detail pages; availability filtering added to search along with amenity filters; new migration `20251127_calendar_urls`.
 - Browse amenity filters now show the same icons as listing detail; image `registry.halla-aho.net/thalla/lomavuokraus-web:e95d9e0` built/pushed and rolled out to staging.
 - Home hero cleaned up (removed sample/browse CTAs), hero FI text updated, and health check link moved to About page runtime section.
@@ -80,8 +80,14 @@
 - Language selector in the navbar aligned with other buttons and given higher-contrast styling.
 - Listing edit page now lets owners delete individual images (with cover/order preserved), and a protected API endpoint handles image removal.
 - Security hardening: npm audit now passes cleanly after upgrading Prisma patch release and pinning `glob@10.5.0` via overrides to eliminate the glob CLI injection advisory in eslint tooling.
+
+## 2025-12-06 — Pricing & amenities
 - Listings now capture separate weekday/weekend prices and new amenities (microwave, free parking) across schema, API, UI, and seeds.
 - Deployed pricing/amenity update image `registry.halla-aho.net/thalla/lomavuokraus-web:bee691e` to staging and production.
+
+## 2025-12-17 — Accessibility & admin UX
+- New amenities added: kitchen, dishwasher, washing machine, barbecue; API/UI/i18n updated and seeds randomized to populate missing prices/amenities. Prisma migration `20250210_more_amenities` applied to shared DB; registry pull secret added to k8s Deployment to avoid image pull errors in prod.
+- Added About and Pricing pages (FI/EN), moved highlights/runtime config to About, and linked footer navigation.
 - Added site favicon generated from the updated logo (`public/favicon.ico`).
 - New admin monitoring dashboard at `/admin/monitor` surfaces Hetzner node status, Kubernetes nodes/pods health, and PostgreSQL connection/size checks with auto-refresh.
 - Netdata installed on k3s node (`node1.lomavuokraus.fi:8443`) and DB host (`db1.lomavuokraus.fi:8443`) behind self-signed TLS + basic auth; DB Netdata includes Postgres metrics via dedicated `netdata` role.