Release: merge development into beta

.github/workflows/code-quality.yml

@@ -143,6 +143,7 @@ permissions:
 
 jobs:
   quality:
+    if: (github.event_name != 'pull_request' || github.head_ref != 'development')
     uses: ConductionNL/.github/.github/workflows/quality.yml@main
     with:
       app-name: keepiq

.gitignore

@@ -122,7 +122,6 @@ openspec/test-site-results/**/*.webp
 docs/node_modules/
 docs/build/
 
-RESTYLE-PLAN.md
 # Agent/test scratch and tool caches — generated, never source.
 # Added by the 2026-08-25 fleet hygiene sweep (ADR-100 Decision 2).
 .stale/

appinfo/info.xml

@@ -36,7 +36,7 @@ Vrij en open source onder de EUPL-1.2-licentie.
 
 **Ondersteuning:** Voor ondersteuning, neem contact op via [email protected].
     ]]></description>
-    <version>0.2.5-unstable.20260831014129</version>
+    <version>0.2.8-unstable.20260831212628</version>
     <licence>EUPL-1.2</licence>
     <author mail="[email protected]" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>Keepiq</namespace>

appinfo/routes.php

@@ -157,6 +157,29 @@
     // but as #[PublicPage], so account-less recipients reach the SPA.
     ['name' => 'publicShell#page', 'url' => '/public', 'verb' => 'GET'],
 
+    // The public shell's SPA catch-all: the router runs createWebHistory
+    // with base /apps/keepiq/public, so recipient links are PATHS
+    // (/public/share/link/{token}, /public/send/{token},
+    // /public/share/request/{token}) and a load or refresh of any of them
+    // must serve the shell. Mirrors the AppHost dashboard#page +
+    // dashboard#catchAll split: a distinct name, because Symfony silently
+    // replaces same-named routes. Sits in $extra, so it precedes the
+    // authenticated /{path} fallback.
+    //
+    // NEVER ROUTE AN AUTHENTICATED ENDPOINT UNDER /public/. This catch-all
+    // ('path' => '.+') matches every GET below /public/ and hands it to a
+    // #[PublicPage] controller, so a session-gated route placed here is
+    // shadowed: the router matches this entry first, the anonymous shell
+    // renders, and the intended handler never runs. The author sees a working
+    // page, not a 404 — a routing slip becomes a silent auth bypass. The shell
+    // itself exposes no data (it returns the HTML template and nothing else),
+    // so there is no live vulnerability; the shape is the hazard.
+    // tests/Unit/AppInfo/PublicRouteSurfaceContractTest.php enforces this:
+    // every /public route must declare #[PublicPage], or the unit suite fails
+    // and names the route.
+    ['name' => 'publicShell#pageCatchAll', 'url' => '/public/{path}', 'verb' => 'GET',
+        'requirements' => ['path' => '.+']],
+
     // Compliance reporting (compliance-reporting §4) — admin-only, the
     // gate runs in the controller body before any report logic.
     ['name' => 'complianceReport#generate', 'url' => '/api/v1/compliance/reports',               'verb' => 'POST'],

composer.json

@@ -83,7 +83,8 @@
         "optimize-autoloader": true,
         "sort-packages": true,
         "platform": {
-            "php": "8.3"
+            "php": "8.3",
+            "ext-xsl": "1"
         }
     }
 }

eslint-suppressions.json

@@ -32,11 +32,6 @@
       "count": 1
     }
   },
-  "src/components/application/PrivateKeyDownloadDialog.vue": {
-    "@typescript-eslint/no-unused-vars": {
-      "count": 2
-    }
-  },
   "src/components/dashboard/CaHealthCard.vue": {
     "no-console": {
       "count": 1