Remove cascade for now; add Docker/CI and README fix list.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -172,10 +172,34 @@ Linux
 Mac
 ```
 
-## 🐳 Docker Image
+## 🐳 Docker
 
-https://hub.docker.com/r/prvtpro/amnezia-panel
+**Quick start (panel + PostgreSQL 17):**
 
+```bash
+cp .env.example .env
+# set SECRET_KEY and strong POSTGRES_PASSWORD in .env
+docker compose up -d --build
+```
+
+Panel: `http://localhost:5000` (or `APP_PORT` from `.env`).
+
+| File | Purpose |
+| --- | --- |
+| `Dockerfile` | Production image (Python 3.12) |
+| `docker-compose.yml` | Panel + PostgreSQL with healthchecks |
+| `.env.example` | Environment template |
+
+**Environment**
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| `APP_PORT` | `5000` | Host port / in-container listen port |
+| `SECRET_KEY` | (random) | Session signing key — set in production |
+| `DATABASE_URL` | compose DSN | PostgreSQL connection string |
+| `POSTGRES_*` | `amnezia` | DB credentials for the `db` service |
+
+Prebuilt Hub image (upstream): https://hub.docker.com/r/prvtpro/amnezia-panel
 
 ### Initial Login
 *   **Username**: `admin`
@@ -183,6 +207,29 @@ https://hub.docker.com/r/prvtpro/amnezia-panel
 > [!IMPORTANT]  
 > Secure your panel by changing the default password in the **Users** section immediately after first login.
 
+## 🔁 CI/CD
+
+GitHub Actions workflows in `.github/workflows/`:
+
+| Workflow | Trigger | What it does |
+| --- | --- | --- |
+| `ci.yml` | push / PR to `main` | Validate translations, `compileall`, Docker build smoke |
+| `docker.yml` | push to `main` / tags `v*` | Build & push image to GHCR (`ghcr.io/<owner>/<repo>`) |
+| `build.yml` | push / tags `v*` | PyInstaller binaries (Linux / Windows / macOS) + release assets |
+
+## 📋 Fix / changelog (this fork)
+
+Recent panel fixes and changes:
+
+*   **Removed cascade (double VPN)** for now — the feature showed “active” while client traffic often had no working internet; will return after a solid redesign.
+*   **WG/AWG backups**: ZIP export of client `.conf` files + restore of protocol backups from the server UI (with loading feedback so the panel no longer freezes).
+*   **API performance**: in-memory data cache, faster server check/stats, heavy SSH work moved off the event loop.
+*   **Share / guest pages**: one-tap “Copy key” for configs.
+*   **User expiration**: optional countdown that starts on first config use (panel / share / guest / Telegram), with UTC-safe datetime comparison.
+*   **UI icons**: shared SVG icon system (emoji icons removed).
+*   **Docker / CI**: refreshed `Dockerfile` + compose, `.env.example`, CI checks, GHCR image workflow.
+*   **Removed for now**: Hysteria 2 and 3x-ui integration (kept out of the main panel path).
+
 ## 🔧 Project Details
 
 ### API Documentation
@@ -227,8 +274,9 @@ curl -H "Authorization: Bearer $TOKEN" http://your-panel:5000/api/servers/0/ping
 ### Technology Stack
 *   **Backend**: FastAPI (Python), `asyncio` for concurrent SSH/probe work
 *   **Frontend**: Vanilla JS, Jinja2, Custom CSS (Glassmorphism, full set of CSS animations for promo blocks)
-*   **Database**: Local JSON storage (`data.json`) with an `asyncio.Lock` for thread-safe writes
+*   **Database**: PostgreSQL 17 (`DATABASE_URL`) with a dict-compatible store API (`db/`)
 *   **SSH Engine**: Paramiko
+*   **Deploy**: Docker Compose (panel + Postgres), optional GHCR image via CI
 
 ### Project Structure
 
@@ -236,6 +284,7 @@ curl -H "Authorization: Bearer $TOKEN" http://your-panel:5000/api/servers/0/ping
 web-panel/
 ├── app.py                    # FastAPI entry point + all routes
 ├── telegram_bot.py           # Optional Telegram bot integration
+├── db/                       # PostgreSQL store + schema helpers
 ├── managers/                 # Protocol & service managers (one file per protocol)
 │   ├── ssh_manager.py        # SSH abstraction (Paramiko wrapper)
 │   ├── awg_manager.py        # AmneziaWG / AWG 2.0 / AWG Legacy
@@ -244,11 +293,14 @@ web-panel/
 │   ├── telemt_manager.py     # Telegram MTProxy
 │   ├── dns_manager.py        # AmneziaDNS (Unbound)
 │   ├── adguard_manager.py    # AdGuard Home
-│   └── socks5_manager.py     # 3proxy-based SOCKS5
+│   ├── socks5_manager.py     # 3proxy-based SOCKS5
+│   └── backup_manager.py     # Protocol backup / restore on remote hosts
 ├── static/                   # CSS / favicon / vendored JS
 ├── templates/                # Jinja2 templates
 ├── translations/             # en / ru / fr / zh / fa
-└── data.json                 # Panel state (servers, users, tokens, settings)
+├── Dockerfile                # Panel image
+├── docker-compose.yml        # Panel + PostgreSQL
+└── .github/workflows/        # CI, Docker publish, binary builds
 ```
 
 ## 🛡 Security Recommendations