Focus the Audit & Report tab, scope API tokens

AppImage/messages/de/common.json

@@ -2469,7 +2469,15 @@
       "legacy": "Vermächtnis",
       "revoke": "Widerrufen",
       "loading": "Token werden geladen...",
-      "empty": "Noch keine API-Tokens."
+      "empty": "Noch keine API-Tokens.",
+      "scope": {
+        "label": "Token permissions",
+        "readOnly": "Read-only",
+        "readOnlyHint": "Reads metrics and status. Recommended for dashboards and integrations.",
+        "fullAdmin": "Full admin",
+        "fullAdminHint": "Full control, like your own session.",
+        "fullAdminWarning": "A full-admin token can do everything you can: power off or reboot the host, run updates and open a terminal. Share it only with fully trusted integrations."
+      }
     },
     "firewall": {
       "title": "Firewall",
@@ -3265,7 +3273,13 @@
       "atomicNotifications": "Notification events reserve their deduplication fingerprint atomically before AI processing and channel delivery, so concurrent collectors, completion callbacks or parallel Monitor processes cannot send the same event twice. The reservation is released when no channel succeeds, preserving retries.",
       "borgSshPort": "Borg remote target — the Add Borg destination dialog and the shell TUI accept a custom SSH port. BORG_RSH, the auto key install flow and the capacity probe all honour it. Fully backwards compatible with existing entries created without an explicit port (suggested by @songochain in discussion #236).",
       "githubToken": "Settings → GitHub API accepts an optional personal access token for release and tag checks when the anonymous quota is exhausted. The token is encrypted at rest and never returned to the browser; the rate-limit error is translated in every Monitor language (suggested by @SystemIdleProcess in discussion #306).",
-      "replicationContext": "Native Proxmox replication failure notifications resolve the replication job ID, affected VM/LXC ID and guest name; the exact error block from Proxmox is preserved as the reason, and each replication job deduplicates independently (reported by Ale R.)."
+      "replicationContext": "Native Proxmox replication failure notifications resolve the replication job ID, affected VM/LXC ID and guest name; the exact error block from Proxmox is preserved as the reason, and each replication job deduplicates independently (reported by Ale R.).",
+      "auditAssessment": "Audit & Report — a new page that documents and assesses the node. The Assessment runs a catalogue of checks across security, backups, capacity, storage, network, hardware, guests and system, classifying each finding as critical, warning, observation or conformant and stating what it read rather than judging it.",
+      "changeJournal": "Change journal — a Changes view that lists exactly what ProxMenux modified on this host: every configuration file, package and service it touched, with the prior state of each, deduplicated to a current-state view that shows the host as it stands now rather than a log of every run.",
+      "auditReports": "Reports — a full audit plus focused Security review, Backup assurance and Capacity & wear reports, each opening on its own posture header, and a printable Inventory; all export to PDF. A security assessment asks before running Lynis so a run stays fast.",
+      "auditPolicyBaseline": "Policy and baseline — declare what the host is expected to be (backup requirements, firewall, root SSH login) so findings grade against it, mark a run as the reference, and see what changed since, with new, resolved and accepted findings kept apart.",
+      "groupedAppUpdates": "Grouped application update notifications — one complete message per scan instead of one per application, grouped by LXC with the installed and available versions.",
+      "adminTokenScope": "Administrative scope — opening a Monitor terminal and disabling authentication now require a full-admin token, so a read-only API token issued to a monitoring integration stays read-only (reported by @f3rs3n)."
     }
   },
   "network": {
@@ -5812,7 +5826,13 @@
       "diagnosticUnread": "Nicht durchführbare Messungen",
       "diagnosticMoreRows": "{count} weitere Zeile(n), in der vollständigen Prüfung.",
       "structureTitle": "Struktur und Konfiguration",
-      "structureSubtitle": "Wie {node} aufgebaut und konfiguriert ist"
+      "structureSubtitle": "Wie {node} aufgebaut und konfiguriert ist",
+      "postureTitle": "Posture",
+      "posture": {
+        "security": "Host exposure and access.",
+        "backup": "Guest protection and whether it is real.",
+        "capacity": "Room to grow and the wear on the disks."
+      }
     },
     "results": "Ergebnisse",
     "classifications": {
@@ -5959,6 +5979,14 @@
         "insufficient_runs": "Ein Vergleich braucht einen Referenzlauf und einen späteren; bisher ist nur einer aufgezeichnet"
       }
     },
-    "notApplicableScope": "Im geprüften Umfang gibt es nichts, worauf diese Prüfung zutrifft."
+    "notApplicableScope": "Im geprüften Umfang gibt es nichts, worauf diese Prüfung zutrifft.",
+    "lynis": {
+      "title": "Run Lynis",
+      "bodyNotRun": "Lynis is installed but has not been run yet. Running it now completes the security review, but the process can take a few minutes.",
+      "bodyStale": "The Lynis report is {days} days old. You can run it now to refresh the data (it takes a little longer) or continue with the existing report.",
+      "withLynis": "Run with Lynis",
+      "withoutLynis": "Run without Lynis",
+      "cancel": "Cancel"
+    }
   }
-}
+}