Add structured vulnerability disclosure policy, response timeline
table, and reporting guidance. Targets the Security-Policy OpenSSF
Scorecard check.

Add npm overrides to force minimatch>=10.2.3 (fixes CVE-2026-27903
ReDoS) and cookie>=0.7.0 (fixes CVE-2024-47764 OOB chars). Dismiss
esbuild alert as tolerable risk — CVE only affects its dev server
which we never use.

Centralizes the safeTimeout pattern (auto-tracked setTimeout with
cleanup) into $lib/safeTimeout.ts. Components that previously defined
this inline can now import createSafeTimeout instead.

Remove SpeedPill component, playbackSpeed store, and all playbackRate
props from ReelVideo, ReelMusic, and ReelIndicators. Feature was broken
and unused.

- Add Secure flag to session, theme, and accent cookies
- Add length guard before timingSafeEqual to prevent crash
- Block pre-onboarding API access (empty username check)
- Add username validation (length, format, group-scoped uniqueness)
- Optimize getUserWithGroup to single JOIN query
- Remove unused getUser export

- Add Platform, ClipStatus, ContentType literal unions to types.ts
- Apply literal types to FeedClip and ClipSummary interfaces
- Migrate AddVideo, share, and share/setup from $app/stores to $app/state

…load

- Wrap all db.transaction() calls in try/catch across 6 API routes
- Extract startDownload to shared clip-download.ts module
- Add transaction to share endpoint clip+watched inserts
- Move push notification outside favorite toggle transaction
- Remove PATCH /api/clips/[id] (caption editing removed from UI)

- Combine getMaxFileSize into single JOIN query
- Add getClipWithMaxFileSize for download pipelines (1 query vs 4)
- Reuse clip record in video/music download to avoid re-fetching
- Merge clip count + storage sum into single query in group/stats

- Include 'mention' type when marking comments as read
- Fix daily reminder sending every hour (dedup via notification row)
- Detect iPadOS via maxTouchPoints for install banner
- Guard PATCH /api/group/shortcut against empty body clearing URL
- Return error for invalid mark-read request body
- Convert avatar endpoint to async fs and JSON error responses
- Fix icon paths in manifest and install banner (SVG → PNG)
- Fix pushsubscriptionchange missing VAPID key in service worker
- Merge fetchClips/fetchMoreClips into single function with offset
- Make updateAppBadge and shortcutNudgeDismissed private

- Create Toggle.svelte and SettingRow.svelte shared components
- Deduplicate toggle/setting-row CSS from settings page and
  NotificationSettings
- Replace RetentionPicker SVG data URI with inline SVG for theming
- Add error handling to RetentionPicker API call
- Remove dead code from ClipsManager (storage bar, _deleting state)
- Fix MemberList phone formatting to use $lib/phone imports
- Fix MemberList createdAt type (string → number with epoch conversion)
- Remove unused groupId prop from MemberList
- Use basename() utility in ClipRow

- Replace drag handle with close button in BaseSheet
- Add close buttons to AddVideoModal and ShortcutGuideSheet
- Migrate all sheets to shared safeTimeout utility
- Wire openSheet/closeSheet in ActivitySheet and ViewersSheet
- Remove duplicate header markup from ActivitySheet and ViewersSheet
- Remove empty onkeydown handlers from overlay divs
- Remove sheet-hidden class from bottom tabs (handled by z-index)
- Remove caption editing from ClipOverlay
- Fix ShortcutGuideSheet hardcoded color and spelling

- Add ContributorPill component (auto-expand on contributor change)
- Move user info from ReelOverlay to ContributorPill in top-left
- Add cycling comment previews to CommentPrompt bar
- Add deferred watched marking for last unwatched clip
- Convert feed page onMount/onDestroy to $effect
- Add touch event isolation to overlay elements
- Add aria-label to comment button in ActionSidebar
- Replace hardcoded colors with CSS tokens in CommentRow and FilterBar
- Use basename() utility for thumbnail paths in feed pages
- Deduplicate getThumbnailSrc with {@const} in favorites grid
- Remove caption editing from feed and favorites

- Fix apple-touch-icon and favicon paths (SVG → PNG)
- Adjust nav bar icon sizes for consistency
- Add REFACTOR-TRACKER.md to gitignore

Export resetLastContributor so the feed page can reset state on
filter/sort changes, preventing stale contributor pill expansion.

Remove watched status badges and watchPercent tracking. Compact the
panel width, avatar sizes, and row layout for a cleaner viewers list.

- Increase notification button to 44px touch target
- Align top-right-row positioning with new button size
- Switch comment prompt to icon circle background
- Adjust ContributorPill expanded padding
- Fix FilterBar inactive tab opacity

Slow down contributor pill expand/collapse transitions, delay expansion
by 1s, and detect overlap with the filter bar to dim it during the
animation. Prevents visual clutter when both elements occupy the same
space.

The PATCH handler was removed in a previous commit but the tests were
not cleaned up, causing CI failures.