chore(release): v1.4.24

Security + accessibility hardening release. Closes the highest-priority
findings from a focused security audit of the v1.4.23 release:

- Bearer auth fail-closed when a route declares no scope (api-handler)
- Public /api/send Umami proxy now rate-limits 120 req/min/IP
- Proxy nonce generation switched to btoa(...) for Edge portability
- Session-expiry delete race uses deleteMany + catch (no more 500s)
- POST /api/import returns the standard apiError envelope on 422
- Runtime Docker image pins Prisma 7.8 + worker deps to minors
- Notifications page renders a real load-error alert
- Accessibility: switch aria-labels, htmlFor pairing, mobile admin
  Overview link, deep-link anchors on notification settings
- Chart overlays: per-chart comparisonBaseline pref, BMI/bodyFat/
  sleep/steps overlay keys, TrendCard layout tolerates long labels

Verification: pnpm typecheck && pnpm lint && pnpm test (2244/2244)
&& pnpm format:check all green.

src/app/api/admin/monitoring/umami-test/route.ts

@@ -6,6 +6,10 @@ import { getPublicMonitoringSettings } from "@/lib/monitoring-settings";
 
 export const dynamic = "force-dynamic";
 
+function redact(text: string): string {
+  return text.replace(/https?:\/\/\S+/gi, "[url]");
+}
+
 function resolveUmamiSendUrls(scriptUrl: string | null): string[] {
   if (!scriptUrl) return [];
   try {
@@ -112,6 +116,8 @@ export const POST = apiHandler(async (request: NextRequest) => {
     break;
   }
 
-  getEvent()?.addWarning("Umami test event rejected: " + lastStatus);
+  getEvent()?.addWarning(
+    `Umami test event rejected: ${lastStatus}${lastDetails ? ` ${redact(lastDetails)}` : ""}`,
+  );
   return apiError(`Umami test event rejected (HTTP ${lastStatus})`, 502);
 });