[frahlg]

Paired Core change srcfl/ftw#1786 is merged as 767b144a931da6a731c619a79483bd0013146e20. Core post-merge CI passes, including the Go race detector (test run 39629397313). The owner requested inclusion in the beta already being prepared; this PR does not start a separate Core release.

Open FTW inside Home Assistant using the existing HA administrator login. Enable ingress on port 18099, keep host networking for equipment, remove the direct web port/link, and force ingress mode in the wrapper and image. Supervisor's default administrator-only panel remains in force. Its built-in Show in sidebar toggle opens FTW in HA. The FTW panel title/icon and clearer sidebar instructions take the sidebar details from #26; this uses the ingress listener already provided by Core. The new Core mode handles setup, saved passwords, iframe security and URL prefixes.

Health checks use only the local health route. The native smoke test uses a Supervisor-addressed peer, rejects forged ingress headers from another peer, and keeps the restart, persistence, solver and cold restore checks. App-only revisions use 0.X.Y-betaN-R, verified with Supervisor's AwesomeVersion 25.8.0; syncing the same Core tag preserves that revision and a newer beta replaces it normally.

Draft: requires a published native beta containing Core #1786. The pin is still the existing public package, which lacks ingress and continues listening on 8080. Both native CI tests therefore fail the 18099 health check. Do not merge or install this draft. After the dependency is published, move the pin to its verified receipt and update the app revision/changelog to that version.

Validation:

• 183 offline tests, repository checks, shell syntax and HA app lint pass.
• Both native builds succeed; their runtime checks reject the incompatible old Core as expected.
• The full native smoke script passes locally on ARM64 with clean Core 0ace65aa overlaid on the package. This includes ingress, forged-header refusal, worker handshake, restart, cold backup/restore and retained config/custom driver. This proves the paired source integration, not the pending public release package.
• In a separate ARM64 HA OS/Supervisor test app, browser setup, protected settings save and Supervisor restart work through ingress without another password. Direct access returns 403 and ingress without an HA session returns 401. The Info page's Show in sidebar switch creates and removes the shortcut, survives a page reload, and clicking the shortcut opens FTW inside HA without another login.

Final package CI and real-device update await the new native beta. No real equipment, credentials, Cloud terms or user's HA configuration were changed. MQTT and native HA entities are not changed by this PR.