chore(release): v1.4.45 — analytics 9 s perf fix + audit-marathon closure + v1.4.44 hotfix merged

Audit-marathon close: 14 waves + W10 QA + reconcile. Perf fix (analytics 9 s -> 2-3 s), Zod multi-issue rollout (41 routes), Withings parked-state automation, mobile-UI WCAG 2.5.5 close, QoL i18n + offline banner + account delete, security PII drop + replay-injection scan. Migration 0075 required. Tests 4815 -> 5076.

src/app/api/admin/users/[id]/__tests__/route.test.ts

@@ -205,4 +205,40 @@ describe("PUT /api/admin/users/[id]", () => {
     const res = await PUT(r, params("u1"));
     expect(res.status).toBe(415);
   });
+
+  describe("v1.4.43 W6 — multi-issue 422 envelope", () => {
+    it("surfaces TWO simultaneous validation errors", async () => {
+      // Bad username (too short) + bad role enum.
+      const res = await PUT(
+        jsonReq({ username: "x", role: "GOD" }),
+        params("u1"),
+      );
+      expect(res.status).toBe(422);
+      const body = (await res.json()) as {
+        data: null;
+        error: string;
+        details: {
+          issues: Array<{ path: string; code: string; message: string }>;
+        };
+      };
+      expect(body.data).toBeNull();
+      expect(body.error).toBe("Validation failed");
+      expect(body.details.issues.length).toBeGreaterThanOrEqual(2);
+      for (const issue of body.details.issues) {
+        expect(Object.keys(issue).sort()).toEqual(["code", "message", "path"]);
+      }
+    });
+
+    it("surfaces THREE simultaneous validation errors", async () => {
+      const res = await PUT(
+        jsonReq({ username: "x", email: "not-an-email", role: "GOD" }),
+        params("u1"),
+      );
+      expect(res.status).toBe(422);
+      const body = (await res.json()) as {
+        details: { issues: Array<unknown> };
+      };
+      expect(body.details.issues.length).toBeGreaterThanOrEqual(3);
+    });
+  });
 });

src/app/api/admin/users/[id]/route.ts

@@ -5,6 +5,7 @@ import {
   apiSuccess,
   apiError,
   getClientIp,
+  returnAllZodIssues,
   safeJson,
 } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
@@ -38,7 +39,8 @@ export const PUT = apiHandler(
     if (jsonError) return jsonError;
     const parsed = updateUserSchema.safeParse(body);
     if (!parsed.success) {
-      return apiError(parsed.error.issues[0].message, 422);
+      // v1.4.43 W6 — multi-issue 422.
+      return returnAllZodIssues(parsed.error, 422);
     }
 
     const target = await prisma.user.findUnique({ where: { id } });