chore: add .gitignore and track frontend/package-lock.json

.gitignore

@@ -0,0 +1,26 @@
+# Python
+__pycache__/
+*.py[cod]
+*.pyo
+.env
+.venv/
+venv/
+
+# Frontend
+frontend/node_modules/
+frontend/dist/
+frontend/.env.local
+
+# Generated shorewall output
+shorewall/
+shorewall.tar.gz
+
+# Secrets
+secrets
+secrets/
+
+# Editor / OS
+.DS_Store
+.idea/
+.vscode/
+*.swp

README.md

@@ -81,6 +81,31 @@ On the Config Detail page, click **Generate Config**:
 
 ---
 
+## Command-Line Download
+
+Each config has a **Download Token** — a secret string that allows downloading the generated ZIP without an OIDC session. This is useful for automation scripts and CI pipelines.
+
+### Finding your token
+
+Open a config in the UI. The **Download Token** field is shown above the tabs. Click the copy icon to copy it.
+
+### Downloading via curl
+
+```bash
+curl -X POST "https://<host>/api/configs/<config-id>/generate?format=zip" \
+  -H 'Content-Type: application/json' \
+  -d '{"token": "<your-download-token>"}' \
+  -o shorewall.zip
+```
+
+Replace `<config-id>` with the numeric ID visible in the URL when you open a config (e.g. `/configs/1`).
+
+### Rotating the token
+
+Click the **Regenerate** button (⟳) next to the token field. The old token is immediately invalidated. You will need to update any scripts that use it.
+
+---
+
 ## API Documentation
 
 FastAPI generates interactive docs automatically: