v1: cleanup, dead code removal, docs update

app.py:
- Move warnings import to top-level imports
- Remove MICRONAS_SECRET env var (undocumented, unnecessary)
- Inline secret key derivation cleanly

CLAUDE.md:
- Remove stale quotas mention
- Add WebDAV, setup.html, favicon to file layout
- Document /etc/micronas/ permissions requirements
- Document <Location> vs <Directory> for WebDAV DAV On

PLANNING.md:
- Mark Phase 5 complete with all shipped items
- Add v1 complete marker and future ideas section

README.md:
- Simplify dev/test section (remove complex hash snippet)
- Fix double blank line

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

PLANNING.md

@@ -114,9 +114,27 @@ MicroNAS/
 - [x] WebDAV badge in dashboard shares overview.
 - [x] @groupname fix in SMB valid users (was incorrectly rejected by VALID_NAME).
 
-### Phase 5 — Nice-to-have
-- [ ] Simple in-browser file browser for `/srv`.
-- [ ] Auto-create share directory on add (with correct owner/permissions).
+### Phase 5 — Security & UX ✅
+- [x] **PBKDF2 password hashing** — admin credentials stored hashed (SHA-256, 260k iterations, salt$hex) in `/etc/micronas/micronas.env`. Legacy plaintext still accepted for migration.
+- [x] **First-login setup page** — `/setup` route shown on fresh install, no manual env editing needed.
+- [x] **Admin credential change** — ⚙ Settings modal in topbar; requires current password, logs out after change.
+- [x] **Config directory** — `/etc/micronas/` with correct ownership (`root:www-data`, mode 750) auto-created by code.
+- [x] **WebDAV browser access** — `Options Indexes` + `<Location>` blocks for DAV On; directories browsable in browser.
+- [x] **Favicon & logo** — SVG drive-bay icon, shown in browser tab and topbar.
+- [x] **www-data in owner dropdown** — selectable as folder owner for WebDAV shares.
+
+---
+
+## v1 complete 🎉
+
+All planned phases shipped. The app manages SMB, NFS, and WebDAV shares with
+a dark-themed web UI, secure hashed credentials, auto-synced WebDAV passwords,
+group management, dashboard with live status, and a favicon.
+
+### Possible future additions
+- Simple in-browser file browser for `/srv`.
+- Auto-create share directory on add (with correct owner/permissions).
+- HTTPS via Let's Encrypt / self-signed cert.
 
 ---