Pull request 204: 7985-fix-contol-profile

Merge in GO/adguard-home-wiki from 7985-fix-contol-profile to master

Squashed commit of the following:

commit e81b6d65a7b4edad1eb23c8948b91bc4d7256707
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Wed Aug 27 13:44:57 2025 +0300

    Configuration: upd docs

Configuration.md

@@ -365,7 +365,7 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
   section [Profiling with pprof](#pprof).
     - `enabled`: Profiling handler status.
     - `port`: IP port to listen on.
-- `users`: Web users info.
+- `users`: Web user info.  If set to an empty list (`[]`), authentication is disabled.
   - `name`: User name.
   - `password`: BCrypt-encrypted password.
 - `auth_attempts` (**after v0.106.0**): Maximum number of failed login attempts
@@ -375,6 +375,9 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
   entire blocking logic is disabled if it equals to 0.
 - `http_proxy`: Proxy URL for HTTP client, e.g. `http://user:password@server:port/`.
   Supports `http`, `https` and `socks5` schemes.
+- `language`: UI language code, e.g. `en`.
+- `theme` (**since v0.107.22**): The UI theme.  The possible values are:
+  `auto`, `dark`, `light`.
 - `web_session_ttl` (**before v0.107.33**): Web session TTL (in hours), a web
   user will stay signed in for this amount of time.
 - `debug_pprof` (**before v0.107.36**): Enable pprof HTTP server listening on
@@ -573,10 +576,14 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
           the value is `true`.
 
   - **ECS settings**
-    - `edns_client_subnet` — Add EDNS Client Subnet (ECS) option to upstream
+    - `edns_client_subnet` (**before v0.107.26**): Add EDNS Client Subnet (ECS) option to upstream
       requests and log the values sent by the clients in the query log.  Please
       note that ECS option will be added automatically for clients with public
       IP addresses only.
+    - `edns_client_subnet` (**since v0.107.26**): Controls EDNS Client Subnet behavior.
+      - `enabled`: Add the ECS option to upstream requests.
+      - `use_custom`: Send a fixed subnet instead of the real client network.
+      - `custom_ip`: The IP address from which to derive the fixed subnet when `use_custom` is `true`.
   - **Access settings:**
     - `allowed_clients`: The list of CIDRs, IP addresses or ClientIDs of allowed
       DNS clients.  If this list has entries, AdGuard Home will accept requests
@@ -614,6 +621,7 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
       3.  `X-Real-IP`
       4.  `X-Forwarded-For`
   - **DNS cache settings**
+    - `cache_enabled` (**since v0.107.65**): Turn the DNS cache on or off globally.
     - `cache_size` — DNS cache size (in bytes).
     - `cache_ttl_min` — The minimum TTL override, in seconds.  If the TTL of
       a response from upstream is below this value, the TTL is replaced with it.
@@ -665,8 +673,6 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
       servers.  Zero value will be rewritten with default one which is `10s`.
     - `serve_http3` (**since v0.107.15**): Enables DNS-over-HTTP/3 serving for
       DNS-over-HTTPS clients as well as for the web UI.
-    - `theme` (**since v0.107.22**): The theme of UI.  The possible values are:
-      `auto`, `dark`, `light`.
     - `serve_plain_dns` (**since v0.107.42**): Enables plain DNS serving.
 
       **NOTE:** `serve_plain_dns` cannot currently be set to `false` unless one
@@ -727,6 +733,7 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
           'answer': A
       ```
 
+    - `safe_fs_patterns` (**since v0.107.53**): List of allowed filesystem path patterns for adding **local** filter files.
     - `cache_time`: Time interval in minutes for keeping cache records.
     - `filters_update_interval`: Time interval in hours for updating filters.
     - `blocked_services`: Blocked services settings section:
@@ -794,7 +801,7 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
   - `url` — URL pointing to the filter contents (filtering rules).
   - `name` — Name of the filter. If it's an adguard syntax filter it will get updated automatically, otherwise it stays unchanged.
   - `last_updated` — Time when the filter was last updated from server.
-  - `ID` - filter ID (must be unique).
+  - `id` - filter ID (must be unique).
 - `dhcp` - Built-in DHCP server configuration.  See also the [DHCP] article.
   - `enabled` - DHCP server status.
   - `interface_name` - network interface name (`eth0`, `en0`, and so on).
@@ -805,6 +812,8 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
       address range.
     - `lease_duration` - lease duration in seconds.  If `0`, use the default
       duration of 24 hours.
+    - `icmp_timeout_msec`: Time to wait for an ICMP reply to detect an IP
+      conflict, in milliseconds.  If `0`, the feature is disabled.
     - `options` - custom DHCP options.  See the [DHCP] article section on these
       options for more information.
   - `dhcpv6` - DHCPv6 settings.
@@ -854,11 +863,12 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
   - `strict_sni_check`: If `true`, reject connections if the client uses server
     name (in SNI) that doesn't match the one in the certificate.
   - `private_key`: The PEM-encoded private key.
-  - `icmp_timeout_msec`: Time to wait for an ICMP reply to detect an IP
-    conflict, in milliseconds.  If `0`, the feature is disabled.
+  - `certificate_path`: Filesystem path to a PEM certificate.
+  - `private_key_path`: Filesystem path to a PEM private key.
   - `override_tls_ciphers`: If set, this array of strings allows overriding the
     default set of TLS cipher suites to use.  The strings are the [names of
     cipher suites][tls-names].
+- `whitelist_filters`: List of **allow-list** filters.
 - `user_rules` — User-specified filtering rules.
 - `os` (**since v0.107.0**) — Operating system related settings.
   - `group` — The name of the user group to switch to after the startup.
@@ -901,6 +911,7 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
       - `hosts`: Follow the operating system’s hosts files.
 - **Log settings**
   - `log` (**since v0.107.34**): Log settings.
+    - `enabled` (**since v0.107.52**): Enable or disable writing to logs.
     - `file` (**since v0.107.34**): Path to the log file.  If empty, writes to
       stdout, if `syslog` writes system log (or eventlog on Windows).
     - `compress` (**since v0.107.34**): If `true`, enabled GZIP compression of