docs: sync with the main repo's October docs; mirror in website.pen

src/content/docs/air-gapped-installation.mdx

@@ -70,7 +70,8 @@ Collect **all of the following by digest** (immutable hash references, not mutab
   - `ghcr.io/valgulnecron/gameplane/tunnel-tailscale` (via `tunnelImages.tailscale`, relay tunnel components, optional)
   - `ghcr.io/valgulnecron/gameplane/tunnel-playit` (via `tunnelImages.playit`, relay tunnel components, optional)
 - **Game modules** — all bundles from `ghcr.io/valgulnecron/gameplane-modules`, versioned per your module source config
-- **CRD manifests** — the eight CRD schemas (bundled in the chart)
+- **CRD manifests** — the CRD schemas (bundled in the chart)
+- **CRD-apply hook image** — the `kubectl` image behind `crds.autoApply.image` (default `registry.k8s.io/kubectl:v1.36.3`). The hook runs on every `helm upgrade`, and also on a `helm install` over Gameplane CRDs that an earlier, uninstalled release left behind. A genuinely fresh first install does not run it. Any image with `kubectl` on its `PATH` works.
 - **Cosign public keys** — `cosign.pub` (current key, ECDSA P-256) and `cosign-legacy.pub` (pre-rotation, Ed25519)
 - **Signatures** — Cosign signatures (recorded in Rekor for v0.2.0-beta.8 onward) and SBOMs, available as separate OCI artifacts in the same registry namespace
 
@@ -218,6 +219,12 @@ operator:
   configInitImage: registry.internal.corp/busybox  # instead of busybox
   resticImage: registry.internal.corp/restic:latest  # instead of restic/restic
   sentinelImage: registry.internal.corp/gameplane/sentinel:0.2.0-beta.8
+
+# Mirror the CRD-apply hook's kubectl image (needed at upgrade time and on
+# an install over leftover CRDs)
+crds:
+  autoApply:
+    image: registry.internal.corp/kubectl:v1.36.3
 ```
 
 ### Pre-provision dependencies

src/content/docs/api-realtime-development.mdx

@@ -55,7 +55,7 @@ Authorization is role-based with three built-in roles (admin, operator, viewer)
 
 Every request has a logical cluster and namespace. The API resolves these via:
 
-- **Cluster:** extracted from `?cluster={name}` query param (defaults to `local` — the install cluster), validated against the Cluster CRD registry
+- **Cluster:** extracted from `?cluster={name}` query param (defaults to `local` — the install cluster), validated against the Cluster CRD registry. Collection reads under `/fleet/*` (v0.3.0) instead combine every authorized scope, with optional cluster and namespace filters; each item carries an explicit `{cluster, namespace, name, uid}` target, and unavailable or truncated scopes are reported rather than silently dropped.
 - **Namespace:** extracted from the URL path (`/servers/{name}` → namespace from server lookup) or defaulted to the user's home namespace
 
 Scope middleware (`internal/scope/`) extracts both before the handler runs. If a user tries to access a namespace they lack permission for, the handler returns `403 Forbidden` with a safe message (no namespace-existence leakage).

src/content/docs/architecture.mdx

@@ -17,7 +17,7 @@ import ArchFlow from "../../components/docs/ArchFlow.astro";
     { icon: "boxes", title: "Kubernetes", subtitle: "Cluster" },
     { icon: "cpu", title: "Agent", subtitle: "Sidecar" },
   ]}
-  caption="Console and log traffic flow API ↔ Agent directly over mTLS; the Operator provisions and reconciles both."
+  caption="In the home cluster, console and log traffic flow API ↔ Agent directly over mTLS; the Operator provisions and reconciles both. Remote clusters go through an optional gateway (below)."
 />
 
 ## Why two control planes
@@ -32,6 +32,28 @@ A dashboard action cascades: API → Operator → StatefulSet → Agent → hear
 
 ModuleSource CRs declare where templates come from — OCI registry, git, HTTP, local, or dashboard upload.
 
+## Multiple clusters and the gateway
+
+One central API and dashboard can manage independent clusters registered as `Cluster` resources. Each target cluster runs its own operator, and optionally a private gateway built from the API image. The gateway has no database, no user login and no browser or admin routes. Users authenticate only to the central API, which stays the authorization authority.
+
+<ArchFlow
+  nodes={[
+    { icon: "laptop", title: "Browser", subtitle: "User" },
+    { icon: "server", title: "Central API", subtitle: "AuthZ" },
+    { icon: "network", title: "Gateway", subtitle: "Per cluster" },
+    { icon: "cpu", title: "Agent", subtitle: "Sidecar" },
+  ]}
+  caption="Central API ↔ Gateway uses a dedicated mTLS trust and an exact enrolled client URI SAN; Gateway ↔ Agent uses the local agent mTLS and UID-bound routes."
+/>
+
+- **Resource requests** carry `?cluster=<name>` and go to that cluster's Kubernetes client. Omitting it targets the built-in `local` cluster. Collection reads under `/fleet/*` instead combine authorized scopes by default, with optional cluster and namespace filters; each item keeps its target identity and permissions, and partial results report unavailable or truncated scopes.
+- **Pod logs and PTY attach** resolve the Kubernetes client for each connection from the registry; unknown or removed clusters fail closed. The API checks the GameServer, StatefulSet and Pod owner UIDs first. Kubernetes log and attach APIs address Pods by name, so this is a preflight check, not an atomic guarantee across deletion and recreation.
+- **RCON, game log files, files, players, live status and agent-based mods** use the selected cluster's gateway. It verifies the central peer certificate, its own cluster ID, the GameServer UID and the owned agent Service, then reaches the agent over local DNS and agent mTLS. Versioned agent routes verify the UID on the final hop; older agents fail closed. Browser cookies, bearer tokens and CSRF headers are never forwarded.
+- **Capture downloads and cleanup** use a separate gateway route bound to both the GameServer and NetworkCapture UIDs; the sidecar verifies a persisted file identity.
+- **Existing local installs** keep direct API-to-agent connections. Remote gateway access needs both private gateway reachability and direct Kubernetes API access from the central API; it does not tunnel Kubernetes operations or replicate game storage.
+
+The `Cluster` health phase reports Kubernetes connectivity and does not probe the gateway. See the [remote agent gateway guide](../remote-agent-gateway/) for installation and the [multi-cluster guide](../multi-cluster/) for what works across clusters. The gateway ships in v0.3.0.
+
 ## Optional components
 
 Beyond the core operator, API, and agent, Gameplane ships optional services for specialized tasks. Optional components (mcp-server, telemetry-receiver, audit-syslog-bridge) are covered in [Extension services](../extension-services/). For a full catalog of all CRDs and their fields, see the [CRD catalog](../crd-catalog/).

src/content/docs/audit-observability-admin.mdx

@@ -36,13 +36,9 @@ Use fleet metrics for symptom detection, Kubernetes events for control-plane cau
 
 Configure event sinks, instance identity, external URL, update channel, and build information as shared operational contracts.
 
-<DocsCallout icon="check" title="Coming in v0.3.0">
-  Notifications (webhook, ntfy, Slack, SMTP) arrive in v0.3.0. Upgrade when available to route server lifecycle events, backups, and alerts to your team's incident channels.
-</DocsCallout>
-
 ### Notification sinks
 
-Once available, multiple sink kinds support event routing:
+Multiple sink kinds support event routing:
 
 - **Webhook**: POST each event as JSON to a URL (e.g., a custom integration endpoint)
 - **ntfy.sh**: POST to a public or self-hosted ntfy topic with optional authentication

src/content/docs/backups-recovery.mdx

@@ -22,7 +22,7 @@ Create recoverable snapshots, schedule retention-aware backups, and restore into
 
 ## Create and inspect backups
 
-Use per-server or global views to start snapshots, filter phases, and inspect destination, size, timestamps, and errors.
+Use per-server or global views to start snapshots, filter phases, and inspect destination, size, timestamps, and errors. From v0.3.0, the Backups page groups its filters in a popover on the right of the search row: Location (when several clusters are registered), Server and the current tab's Phase. Selections apply when you click Apply.
 
 <DocsSectionList
   items={[

src/content/docs/changelog.mdx

@@ -13,19 +13,23 @@ import DocsCallout from "../../components/docs/DocsCallout.astro";
 import ChangeEntry from "../../components/docs/ChangeEntry.astro";
 
 <DocsCallout icon="package" title="Coming in v0.3.0">
-  The changes below (Unreleased) are included in v0.3.0-rc.1, tagged but not yet published as a release. They will be available in v0.3.0 GA when it ships.
+  The changes below (Unreleased) include v0.3.0-rc.1 (tagged 2026-09-23, not published) and v0.3.0-rc.2 (in development). They will be available in v0.3.0 GA when it ships.
 </DocsCallout>
 
 <div class="flex flex-col">
   <ChangeEntry version="Unreleased" date="in development" highlight>
+    **Multicluster gateways and unified server management:** an optional private mTLS agent gateway lets one dashboard and API manage authorized game servers across independent clusters, with optional location filters and routed console, files, players, mods and captures.
+    **User theme customization:** Settings → Theme & Appearance offers preset themes (Modern Pink, Legacy Orange) and custom color selection with live WCAG AA contrast validation.
     **Network capture:** admin-only, on-demand packet capture from running game pods as ephemeral sidecars, exported as PCAPNG (Wireshark-compatible).
     **Module authoring toolkit:** gp-module CLI and web dashboard for scaffolding, validating, previewing, and packaging custom game modules.
-    **User theme customization:** preset themes (Modern Pink, Legacy Orange) and custom accent/surface colors with WCAG AA contrast validation.
-    **13 new top-steam-game modules** (FiveM, Farming Simulator 25, Euro Truck Simulator 2, Mount & Blade Bannerlord, tModLoader, Team Fortress 2, BeamMP, Left 4 Dead 2, The Isle, ARK, Arma Reforger, Hell Let Loose, Squad).
+    **PostgreSQL end-to-end support:** the PostgreSQL driver now works end to end, with its own migration set, placeholder rebinding, and database tests in CI. It remains experimental: keep a single API replica.
     **Install-time configuration:** Helm-seeded OIDC role mappings and default StorageClass for game-data PVCs.
     **Share link expiry options:** no-expiry, 15/30/60/90-day presets, or custom date picker.
     **Security audit remediation:** share link isolation, permission checks on GameServer mutations, Secret/ConfigMap reference validation, and symlink/zip-slip guards hardened across mod extraction.
+    **Servers page multi-namespace support:** the Servers list now shows servers from every namespace the viewer may read, not only the default games namespace.
+    **Playit tunnel improvements:** NetworkPolicy egress widened to reach relay, and playit-assigned addresses now show in status.
     **REST and CLI console protocols** for games with HTTP admin APIs (FiveM) and PTY-only games (Terraria).
+    **14 new game modules** (FiveM, Farming Simulator 25, Euro Truck Simulator 2, Mount & Blade Bannerlord, tModLoader, Team Fortress 2, BeamMP, Left 4 Dead 2, The Isle, ARK: Survival Evolved, Arma Reforger, Hell Let Loose, Squad and Nuclear Option), for 30 in total (16 in v0.2.0-beta.8).
   </ChangeEntry>
 
   <ChangeEntry version="v0.2.0-beta.8" date="2026-08-22">

src/content/docs/ci-releases-signing.mdx

@@ -86,6 +86,8 @@ A `v` tag builds and signs images, packages the OCI chart, creates release notes
 
 Release images carry Cosign signatures recorded in the public Sigstore Rekor transparency log. Verify any released or edge image with the `cosign.pub` key at the repo root. Pre-rotation releases (v0.2.0-beta.7 and earlier) used the retired Ed25519 key and require `cosign-legacy.pub` with the `--insecure-ignore-tlog=true` flag (see [Key Rotation](../credential-rotation/) for trust continuity).
 
+Signing is mandatory and fail-closed: without `COSIGN_PRIVATE_KEY` the release job fails before anything is pushed. Every signing job (`release.yaml`, `publish-edge.yaml`, `images.yaml` and `republish-modules.yaml`) runs in the `release-signing` environment, whose deployment policy admits only `master` and `v*` tags, so a run on any other ref never receives the key. Images are pushed by digest, signed and verified, and only then tagged, so a published tag always names a signed image.
+
 ---
 
 ## Next guide

src/content/docs/cluster-nodes-kubeconfig.mdx

@@ -139,7 +139,7 @@ Mint a short-lived token for the intended cluster, run the generated join proced
 
 - **Lifetime:** 24 hours from creation.
 - **Single-use:** The token expires automatically after use; no revocation needed.
-- **Per-cluster:** Each bootstrap token is tied to the cluster the API server was reached from. Multi-cluster installs require generating a token for each control plane.
+- **Per-cluster:** Each bootstrap token is tied to the cluster the API server was reached from. Multi-cluster installs require generating a token for each control plane. Node-join token creation and kubeconfig issuance are local-cluster operations and are unavailable while viewing a remote cluster; remote node inventory instead needs the read permissions listed in the [remote agent gateway guide](../remote-agent-gateway/#grant-inventory-permissions).
 - **CA cert hash:** The discovery token CA cert hash (`--discovery-token-ca-cert-hash`) pins the cluster's root CA and prevents man-in-the-middle attacks. It is always required.
 
 ### Troubleshooting join failures
@@ -166,4 +166,5 @@ Mint a short-lived token for the intended cluster, run the generated join proced
 
 - **[Kubernetes Maintenance](../kubernetes-maintenance/)** — node upgrades, drain procedures, security patches.
 - **[High Availability](../high-availability/)** — control plane redundancy, etcd backup, failover.
-- **[Multi-cluster Topology](../multi-cluster/)** — remote cluster registration and federation.
+- **[Multi-cluster Topology](../multi-cluster/)** — remote cluster registration and the unified cross-cluster dashboard.
+- **[Remote Agent Gateway](../remote-agent-gateway/)** — install and register the per-cluster gateway.

src/content/docs/comparison.mdx

@@ -13,12 +13,12 @@ Pterodactyl and CubeCoders AMP are control panels; Agones is a Kubernetes operat
 | --- | --- | --- | --- | --- |
 | Deployment/runtime model | Kubernetes-native CRDs and controller-runtime operator; scales from k3s homelab to multi-node clusters. [BETA] | Self-hosted Panel with PHP/MySQL/Redis dependencies; Wings backend manages Docker containers. | Web-based control panel supporting Windows (native) and Linux (Debian 10+). | Kubernetes-native library extending K8s with GameServer/Fleet CRDs. |
 | Scaling & auto-sleep | Opt-in idle auto-sleep with configurable wake windows, manual wake button, or wake-on-connect. Minecraft/Terraria full protocol support; others use packet heuristics. [optional] | Multi-node support with cron-based power scheduling; no dedicated idle/auto-sleep feature. | Instance Automatic Sleep feature; multi-server architecture with controller managing instances. | Fleet autoscaling via buffer/webhook strategies; no idle/sleep state. |
-| Inbound connectivity (NAT traversal, relay) | Integrated frp, Tailscale, playit relay sidecars; playit mappings user-managed via playit.gg account. [optional; disabled by default] | No integrated relay sidecars; manual proxy/port forwarding configuration required. | not publicly documented (checked 2026-09-02) | No relay or NAT traversal features documented. |
+| Inbound connectivity (NAT traversal, relay) | Integrated frp, Tailscale, playit relays (a separate tunnel pod per server); playit mappings user-managed via playit.gg account. [optional; disabled by default] | No integrated relay sidecars; manual proxy/port forwarding configuration required. | not publicly documented (checked 2026-09-02) | No relay or NAT traversal features documented. |
 | Backup and restore | Restic snapshots to S3-compatible storage; on-demand or cron-scheduled via BackupSchedule; one-click restore. | Wings (local, default) or S3-compatible backup drivers; cron scheduling and on-demand backups. | not publicly documented (checked 2026-09-02) | not applicable (Agones is a Kubernetes operator library) |
 | Access control & authentication | Local argon2id + OIDC (Keycloak/Google/GitHub); three built-in roles (admin/operator/viewer); custom roles supported. | 2FA configurable per account or admin-only; subuser management via Artisan CLI. | Role-based access control; OIDC single-sign-on in Advanced Edition. | not applicable (Agones is a Kubernetes operator library) |
-| Game template distribution | OCI bundles via ModuleSource (git/http/oci/local/upload); optional cosign signature verification per source. 16 ready-to-use templates shipped. | Community eggs repository (eggs.pterodactyl.io) with nests and custom egg creation support. | Customizable templates framework; community-contributed templates available via external repositories. | not applicable (Agones is a Kubernetes operator library) |
-| Multi-tenancy & multi-cluster | Cluster CRD for remote registration/monitoring; console/log streaming local-cluster only. [local cluster only for streaming] | Single Panel managing multiple nodes; no documented remote cluster or cross-cluster streaming. | Multi-server management via controller architecture; multi-tenancy not supported in AMP 2 (planned for AMP 3). | Multi-cluster allocation via GameServerAllocationPolicy; allocator service with mTLS authentication. |
+| Game template distribution | OCI bundles via ModuleSource (git/http/oci/local/upload); optional cosign signature verification per source. 30 ready-to-use templates on master (16 in v0.2.0-beta.8; the other 14 arrive in v0.3.0). | Community eggs repository (eggs.pterodactyl.io) with nests and custom egg creation support. | Customizable templates framework; community-contributed templates available via external repositories. | not applicable (Agones is a Kubernetes operator library) |
+| Multi-tenancy & multi-cluster | Cluster CRD for remote registration and health checks; in v0.2.0-beta.8 console/log streaming is local-cluster only. From v0.3.0: remote Pod logs/PTY, an optional private gateway for console, files, players, mods and UID-bound capture downloads/cleanup, modpack and ID-list configuration on the selected cluster, and a unified dashboard with location filters. Requires matching gateway, operator, agent and capture-sidecar versions. | Single Panel managing multiple nodes; no documented remote cluster or cross-cluster streaming. | Multi-server management via controller architecture; multi-tenancy not supported in AMP 2 (planned for AMP 3). | Multi-cluster allocation via GameServerAllocationPolicy; allocator service with mTLS authentication. |
 | Licensing | GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later). | MIT License (Panel and Wings). | Proprietary; per-instance tiers (Standard/Professional/Advanced/Enterprise). | Apache License 2.0. |
 | Target operator scope (self-hosted vs. managed SaaS) | Self-hosted only; runs on Kubernetes (k3s, kubeadm, managed services); no managed SaaS offering. | Self-hosted only; requires Linux system capable of running Docker containers. | Self-installed on user hardware (Windows or Linux); no managed SaaS version. | Self-hosted operator software; runs anywhere Kubernetes can run. |
 
-Sources for every cell: [docs/comparison-sources.md](https://github.com/ValgulNecron/Gameplane/blob/master/docs/comparison-sources.md) — Checked 2026-09-02.
+Sources for every cell: [docs/comparison-sources.md](https://github.com/ValgulNecron/Gameplane/blob/master/docs/comparison-sources.md) — Checked 2026-10-02.