feat(web): стабилизация UI, Gemini-скроллинг, роутеры контекста/снапшотов и актуализация роадмапа

modules/web_api/main.py

@@ -32,6 +32,10 @@ from routers.admin import router as admin_router
 from routers.tasks import router as tasks_router
 from routers.chat import router as chat_router
 from routers.files import router as files_router
+from routers.exceptions import router as exceptions_router
+from routers.snapshots import router as snapshots_router
+from routers.remote_workers import router as remote_workers_router
+from routers.context import router as context_router
 
 # ANCHOR[APP_CONFIG]
 logging.basicConfig(
@@ -61,6 +65,10 @@ app.include_router(admin_router)
 app.include_router(tasks_router)
 app.include_router(chat_router)
 app.include_router(files_router)
+app.include_router(exceptions_router)
+app.include_router(snapshots_router)
+app.include_router(remote_workers_router)
+app.include_router(context_router)
 
 # ANCHOR[ROOT_STATIC_ROUTES]
 @app.get("/")
@@ -80,6 +88,12 @@ async def favicon():
 @app.get("/{file_path:path}")
 def serve_static_fallback(file_path: str):
     clean_path = file_path.lstrip("/")
+    
+    # Жесткая блокировка скрытых файлов (.env, .git) и служебных форматов
+    forbidden_patterns = [".env", ".git", ".yml", ".yaml", ".json", ".sql", ".php", ".bak"]
+    if clean_path.startswith(".") or any(p in clean_path.lower() for p in forbidden_patterns):
+        raise HTTPException(status_code=403, detail="Access denied")
+
     target = os.path.join(STATIC_DIR, clean_path)
     
     if os.path.isfile(target):