fix(proxmox): harden console sessions and firewall rollout safety

Reduce security and reliability risk across the Proxmox extension by removing password exposure from Livewire state, hardening console auth/cookie handling, and improving sanitized error paths. Improve firewall and router performance by adding safer lazy loading, bounded pagination, cross-server compatibility guards, and lower-overhead API workflows.

Made-with: Cursor

extensions/Servers/Proxmox/Models/Server.php

@@ -3,7 +3,9 @@
 namespace Paymenter\Extensions\Servers\Proxmox\Models;
 
 use App\Models\Service;
+use Illuminate\Contracts\Encryption\DecryptException;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Crypt;
 
 class Server extends Model
 {
@@ -31,6 +33,10 @@ class Server extends Model
         'tag3color',
     ];
 
+    protected $hidden = [
+        'password',
+    ];
+
     public function node()
     {
         return $this->belongsTo(Node::class);
@@ -65,4 +71,37 @@ class Server extends Model
     {
         return $this->hasMany(ServerStatistics::class);
     }
+
+    public function setPasswordAttribute(?string $value): void
+    {
+        if ($value === null || $value === '') {
+            $this->attributes['password'] = null;
+            return;
+        }
+
+        $this->attributes['password'] = Crypt::encryptString($value);
+    }
+
+    public function getPasswordAttribute(?string $value): ?string
+    {
+        if ($value === null || $value === '') {
+            return null;
+        }
+
+        try {
+            return Crypt::decryptString($value);
+        } catch (DecryptException) {
+            // Refuse to expose undecipherable values to callers.
+            report(new \RuntimeException('Failed to decrypt stored Proxmox server password.'));
+
+            return null;
+        }
+    }
+
+    public function hasStoredPassword(): bool
+    {
+        $rawPassword = $this->getRawOriginal('password');
+
+        return is_string($rawPassword) && trim($rawPassword) !== '';
+    }
 }