Fix log token leakage, orphaned certs, hash routing, icon-reset label, docs/backup theme contrast, and version drift

- Redact sensitive query-string params (token/secret/password/etc.) before storing access logs
- Clean up orphaned certificate files when a site/proxy/redirect is deleted, renamed, or has domains removed
- Add hashchange listener so back/forward navigation and deep links correctly route the app
- Fix activity log showing "undefined" instead of a username when resetting/updating a user's icon
- Fix illegible dark-on-dark text in the Docs page hero banner and the Backup & Restore form fields in light theme
- Give raw validation errors on proxy/site/redirect config routes the same "Gateway configuration rejected:" wording as other config errors
- Serve index.html with the real package.json version baked into the cache-busting query string instead of a stale hardcoded one
- Bump version to 0.11.31

src/public/app.js

@@ -442,6 +442,15 @@ $("#password-form").addEventListener("submit", async event => {
   } catch (error) { $("#password-error").textContent = error.message; }
   finally { button.disabled = false; }
 });
+window.addEventListener("hashchange", () => {
+  if (!state.user) return; // Not logged in yet; boot() handles initial routing.
+  const requestedHash = location.hash.slice(1);
+  state.adminTab = requestedHash.startsWith("administration/") ? requestedHash.split("/")[1] || "users" : "users";
+  if (requestedHash.startsWith("administration/")) history.replaceState(null, "", `${location.pathname}${location.search}#administration`);
+  state.view = location.hash.slice(1) || "overview";
+  render();
+  loadFeatureView().catch(error => toast(error.message));
+});
 boot().catch(error => toast(error.message));
 
 function syncUpstreamTlsControls(form) {