chore(release): v1.4.24

Security + accessibility hardening release. Closes the highest-priority
findings from a focused security audit of the v1.4.23 release:

- Bearer auth fail-closed when a route declares no scope (api-handler)
- Public /api/send Umami proxy now rate-limits 120 req/min/IP
- Proxy nonce generation switched to btoa(...) for Edge portability
- Session-expiry delete race uses deleteMany + catch (no more 500s)
- POST /api/import returns the standard apiError envelope on 422
- Runtime Docker image pins Prisma 7.8 + worker deps to minors
- Notifications page renders a real load-error alert
- Accessibility: switch aria-labels, htmlFor pairing, mobile admin
  Overview link, deep-link anchors on notification settings
- Chart overlays: per-chart comparisonBaseline pref, BMI/bodyFat/
  sleep/steps overlay keys, TrendCard layout tolerates long labels

Verification: pnpm typecheck && pnpm lint && pnpm test (2244/2244)
&& pnpm format:check all green.

src/lib/api-handler.ts

@@ -222,9 +222,22 @@ async function authenticateBearer(
   // adopt requireAuth("scope:name"), the wildcard handling here keeps
   // the iOS app working while narrower-scoped tokens (e.g. ["medication:
   // ingest"]) get correctly 403'd.
+  const hasWildcardPermission = apiToken.permissions.includes("*");
+
+  if (!requiredPermission && !hasWildcardPermission) {
+    auditLog("auth.bearer.failure", {
+      userId: apiToken.userId,
+      details: {
+        reason: "scope_required",
+        tokenId: apiToken.id,
+      },
+    }).catch(() => {});
+    throw new HttpError(403, "Insufficient permissions");
+  }
+
   if (
     requiredPermission &&
-    !apiToken.permissions.includes("*") &&
+    !hasWildcardPermission &&
     !apiToken.permissions.includes(requiredPermission)
   ) {
     auditLog("auth.bearer.failure", {