chore(release): v1.4.24

Security + accessibility hardening release. Closes the highest-priority
findings from a focused security audit of the v1.4.23 release:

- Bearer auth fail-closed when a route declares no scope (api-handler)
- Public /api/send Umami proxy now rate-limits 120 req/min/IP
- Proxy nonce generation switched to btoa(...) for Edge portability
- Session-expiry delete race uses deleteMany + catch (no more 500s)
- POST /api/import returns the standard apiError envelope on 422
- Runtime Docker image pins Prisma 7.8 + worker deps to minors
- Notifications page renders a real load-error alert
- Accessibility: switch aria-labels, htmlFor pairing, mobile admin
  Overview link, deep-link anchors on notification settings
- Chart overlays: per-chart comparisonBaseline pref, BMI/bodyFat/
  sleep/steps overlay keys, TrendCard layout tolerates long labels

Verification: pnpm typecheck && pnpm lint && pnpm test (2244/2244)
&& pnpm format:check all green.

scripts/check-openapi.ts

@@ -22,11 +22,9 @@ function main(): void {
   });
   const committed = readFileSync(SPEC_PATH, "utf8");
   if (generated === committed) {
-    // eslint-disable-next-line no-console
     console.log("OpenAPI spec in sync with source schemas.");
     return;
   }
-  // eslint-disable-next-line no-console
   console.error(
     "OpenAPI spec drift detected. Run `pnpm openapi:generate` and commit the result.",
   );
@@ -37,7 +35,6 @@ function main(): void {
   const max = Math.max(genLines.length, onDiskLines.length);
   for (let i = 0; i < max; i++) {
     if (genLines[i] !== onDiskLines[i]) {
-      // eslint-disable-next-line no-console
       console.error(
         `Line ${i + 1}:\n  generated: ${JSON.stringify(genLines[i] ?? "")}\n  committed: ${JSON.stringify(onDiskLines[i] ?? "")}`,
       );
@@ -46,7 +43,6 @@ function main(): void {
       let shown = 1;
       for (let j = i + 1; j < max && shown < 5; j++) {
         if (genLines[j] !== onDiskLines[j]) {
-          // eslint-disable-next-line no-console
           console.error(
             `Line ${j + 1}:\n  generated: ${JSON.stringify(genLines[j] ?? "")}\n  committed: ${JSON.stringify(onDiskLines[j] ?? "")}`,
           );

scripts/generate-openapi.ts

@@ -28,7 +28,6 @@ function main(): void {
     lineWidth: 120,
   });
   writeFileSync(SPEC_PATH, yaml, "utf8");
-  // eslint-disable-next-line no-console
   console.log(`Wrote ${SPEC_PATH} (${yaml.length} bytes)`);
 }