v0.0.69

feat(stats): Recovery and Consistency tabs honor the period selector

Recovery: drop exercises that weren't performed at all within the selected
period — abandoned exercises no longer clutter the table when looking at
this week or this month.

Consistency: the four stat boxes (Current Streak, Longest Streak, Total
Days, Avg / Week) and their subtitle labels now recompute against the
selected period. The heatmap keeps its 1-year window for visual context
since shrinking it to a single column for "Week" looks broken.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

v0.0.68

fix(stats): Muscle Balance chart plots volume to match its title

The radar chart was rendering set counts despite the panel being titled
"Volume by Muscle Group", and the radial scale labels collided with the
top point label. Plot volume, hide the radial ticks (the breakdown panel
beside the chart already shows exact values), and let the chart fill the
canvas via maintainAspectRatio: false.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

v0.0.67

feat: add 5 new stats tabs for strength tracking

Personal Records — all-time best estimated 1RM (Epley formula) per
exercise, grouped by muscle group, with NEW badge for PRs set in the
current period.

Progressive Overload — line chart of est. 1RM and top-set weight over
time for a selected exercise, period-filtered; shows whether you are
actually getting stronger.

Muscle Balance — radar chart of sets per muscle group plus volume
breakdown cards; highlights push/pull and upper/lower imbalances.

Training Consistency — GitHub-style 52-week heatmap calendar with
current streak, longest streak, total workout days, and avg workouts
per week. Uses server-injected today date for correct timezone.

Rest & Recovery — table of every exercise sorted by overdueness (days
since last / typical interval), with Fresh / Due / Overdue badges.

Also: ServerDate injected into stats page so consistency tab uses
correct timezone-aware today.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v0.0.66

docs: refresh README screenshots with current UI

Updated all five web UI screenshots to show current features:
- Workout: friendly date display, exercise group chips, 7-day streak
- Stats: exercise distribution pie chart, stacked volume bar chart, body weight trend
- Config: settings form with auto-fill toggle and about section

Android screenshots remain coming soon (no test device available).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v0.0.65

fix: inject git tag as VERSION_NAME into Android app at build time

build.gradle.kts reads VERSION_NAME from the environment (set by CI to
github.ref_name, e.g. "v0.0.65") and uses it as versionName. Falls back
to "dev" for local builds. This fixes the Settings screen showing
"PUMP 1.0" instead of the actual release version.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v0.0.64

feat: narrow barbell bar so weights hug the P letters

Shifted each side inward ~60 units (logo) / ~6 units (favicon):
- Left plates: x 28→88 (outer), x 52→112 (inner)
- Bar path endpoints: x 66→126 (left), x 334→274 (right)
- Right plates: x 334→274 (inner), x 350→290 (outer)
assets/logo.svg synced.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v0.0.63

feat: Log Weight button on main page; friendly date display; QR on se…

v0.0.62

fix: resolve CodeQL workflow security findings

autofix.yml — untrusted-checkout/critical:
  - Move checkout to be the FIRST step so git is available for the
    streak check (was a latent bug: git log ran before checkout and
    silently returned 0 every time via || true)
  - Remove ref: head_sha from the checkout action; always check out
    the default branch instead. HEAD_SHA is still used as a data
    value for git-log and push targets but is never executed as code,
    which is what CodeQL's untrusted-checkout rule requires.

binary-release.yml — missing permissions block:
  - Add explicit permissions: contents: write (goreleaser needs this
    to upload artifacts to the release). All other permissions default
    to read, satisfying the least-privilege requirement.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v0.0.61

fix: scope API key to /api/ routes; always log API requests

API_KEY was applied globally via r.Use(), blocking the web browser UI
(which never sends X-Api-Key). The middleware now only enforces the key
on paths starting with /api/ — web UI routes remain accessible from the
browser without any header.

GinMiddleware updated:
- All /api/ requests are now logged at Info level regardless of status,
  so every Android/API client call appears in the server log
- 4xx responses log at Warn, 5xx at Error (unchanged)
- User-Agent is included in /api/ log lines to distinguish client types
- Successful web UI page loads stay silent at Info level (debug only)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v0.0.60

feat: increase PUMP icon text size by 10%

font-size 44 → 48 in logo.svg; viewBox height adjusted 130 → 136 to
avoid clipping. favicon.svg font-size 14 → 15. assets/logo.svg synced.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>