add capability to restrict remote panel modes

README.md

@@ -120,6 +120,7 @@ Application Options:
       --control.max_current_limit= Optional max AC current limit guardrail in amps (0 disables). (default: 0) [$CONTROL_MAX_CURRENT_LIMIT]
       --control.mode_change_min_interval= Minimum time between mode changes. (default: 3s) [$CONTROL_MODE_CHANGE_MIN_INTERVAL]
       --control.lockout_window= Post-command lockout window for command arbitration. (default: 0s) [$CONTROL_LOCKOUT_WINDOW]
+      --control.allowed_panel_modes= Comma-separated allowlist of remote panel modes. Supported values: on, off, charger_only, inverter_only. Empty allows all modes. [$CONTROL_ALLOWED_PANEL_MODES]
       --loglevel=       The log level to generate logs at. ("panic", "fatal", "error", "warn", "info", "debug", "trace") (default: info) [$LOGLEVEL]
 
 Help Options:
@@ -136,6 +137,25 @@ This affects:
 - MQTT command handling (`--mqtt.command_topic` commands are ignored)
 - Web UI control actions (`POST /api/remote-panel/state` and `POST /api/remote-panel/standby`)
 
+### Remote Panel Mode Allowlist
+
+Set `CONTROL_ALLOWED_PANEL_MODES` (or `--control.allowed_panel_modes`) to restrict which
+remote panel modes can be selected from Web UI, MQTT, Home Assistant, and Venus-compatible
+write paths.
+
+Supported values:
+
+- `on`
+- `off`
+- `charger_only`
+- `inverter_only`
+
+Use a comma-separated list. Empty means all modes are allowed.
+
+Example:
+
+- `CONTROL_ALLOWED_PANEL_MODES=off,charger_only`
+
 Example `docker-compose.yml` snippet:
 
 ```yaml
@@ -144,6 +164,7 @@ services:
     image: registry.coadcorp.com/nathan/invertergui:latest
     environment:
       READ_ONLY: "true"
+      CONTROL_ALLOWED_PANEL_MODES: "off,charger_only"
     devices:
       - "/dev/ttyUSB0:/dev/ttyUSB0"
     command: ["--mqtt.enabled", "--mqtt.broker=tcp://192.168.1.1:1883", "--loglevel=info"]