Many changes

README.md

@@ -17,6 +17,9 @@ Scratch content is stored on disk gzip-compressed transparently to reduce filesy
 
 Without `--config`, built-in defaults are used.
 
+If you modify the web UI source (`web/ui`), rebuild frontend assets with:
+- `make build`
+
 ## Configuration
 
 All configuration is YAML.
@@ -29,11 +32,21 @@ All configuration is YAML.
 ### `limits`
 
 - `max_upload_size`: max request body size for uploads.
-  - Examples: `5MB`, `100MB`, `1GiB`
-  - Default: `100MB`
+  - Supported units: `B`, `KB`, `MB`, `GB`, `KiB`, `MiB`, `GiB` (case-insensitive)
+  - If no unit is provided, value is interpreted as bytes
+  - Examples: `5MB`, `100MiB`, `1GiB`, `1048576`
+  - Default: `100MiB`
 - `default_ttl`: expiration applied to new scratches.
   - Must be `> 0` and `<= 24h`
   - Default: `1h`
+- `raw_cache_max_size`: max total decompressed bytes cached in memory for `/api/raw` range requests.
+  - Supported units: `B`, `KB`, `MB`, `GB`, `KiB`, `MiB`, `GiB` (case-insensitive)
+  - Must be `> 0`
+  - Default: `200MiB`
+- `raw_cache_max_entries`: max number of decompressed `/api/raw` entries kept in memory.
+  - Must be `> 0`
+  - Used together with `raw_cache_max_size` as a secondary cap
+  - Default: `32`
 
 ### `storage`
 
@@ -47,6 +60,8 @@ All configuration is YAML.
 
 - `allowed_ips`: optional list of IPs and CIDRs allowed to create scratches.
   - Applies to write route only: `POST /api/scratch`
+  - Default includes `127.0.0.1` (localhost-only write access)
+  - Add trusted IPs/CIDRs for LAN/proxy clients (for example `192.168.1.0/24`)
   - Empty list means no allowlist restriction
 - `trust_proxy_headers`: if `true`, client IP extraction honors `X-Forwarded-For` then `X-Real-IP`.
   - Keep `false` unless behind a trusted reverse proxy that sets these headers.