chore: bump version to 0.35.0 -- Phase 34 complete

feat(phase-34): register forensics, self_learning, case_memory routers

feat(phase-34): add api/routes/case_memory.py with 3 endpoints

feat(phase-34): add api/routes/self_learning.py with 4 endpoints

feat(phase-34): add api/routes/forensics.py with 5 endpoints

feat(phase-34): wire BenfordsAnalyzer + GhostCompanyDetector + ShadowDirectorDetector into risk scorer

chore: bump version to 0.34.0 -- Phase 33 complete

feat(phase-33): register timeline.router in api/main.py

feat(phase-33): add api/routes/timeline.py with 2 endpoints

feat(phase-33): add 4 graph analytics endpoints to api/routes/graph.py

chore: bump version to 0.33.0 -- Phase 32 complete

feat(phase-32): load AliasGraph at startup + register resolve.router

feat(phase-32): add AliasGraph import and singleton to api/main.py

feat(phase-32): register resolve.router in api/main.py

feat(phase-32): add api/routes/resolve.py with 4 endpoints

fix(M-09): confirm dirname guard in save_json; bump version to 0.32.0

fix(NEW-3): expand _FEED_LABELS from 6 to 14 node types

fix(B-01): define _stats_lock -- NameError crashed GET /stats on every call

fix(BACKEND-2): add threading.Lock for _stats_cache -- prevents concurrent full-graph scans

chore: bump version to 0.31.5 -- Sprint 7 complete (31 commits, 30+ bugs fixed)

fix(SEARCH-2,SEARCH-3): add datagov/crimereport filter buttons; add Arabic script U+0600-U+06FF to ALLOWED_CHARS for Urdu/Sindhi search

fix(SEARCH-1): call setup_schema() in API lifespan startup -- fulltext index created on fresh deployment without waiting for daily scrape

fix(BACKEND-1): move rate limiter eviction AFTER current key pruning -- prevents losing rate-limit tracking on burst-after-idle patterns

fix(LOGIC-1): remove 2 duplicate pressrelease keys in LABEL_QUERIES; fix LIMIT $lim -> $limit to match query runner kwarg

fix(SEC-6): reject empty-string ADMIN_SECRET -- empty string was falsy and bypassed authentication check

fix(CodeQL#16-17): use validated real_out path for FileResponse and media_type check in export.py

fix(CodeQL#23): log exception type only in investigation.py -- full exception message may expose Neo4j URI

fix(FEED-3): replace deprecated asyncio.get_event_loop() with get_running_loop() in WebSocket handler

fix(SyntaxError): remove duplicate stats cache block in api/main.py -- global must precede all use of variable

fix(H-07): add 60s cache for /stats endpoint -- prevents full MATCH(n) scan on every homepage load

fix(M-08): add pressrelease alias in LABEL_QUERIES so frontend filter button works

chore: bump version to 0.31.4 -- Sprint 5 complete (36 bugs fixed across 36 commits)

fix(H-07): add 60s cache to /stats endpoint -- prevents full graph scan (MATCH (n)) on every homepage load

fix(M-08): add 'pressrelease' alias key in LABEL_QUERIES -- frontend filter button now correctly filters to PressRelease nodes

fix(M-03,M-06,M-08): add mobile CSS overrides for inline grid layouts; add NONE risk level for score=0; clamp risk score to 0-100

fix(CodeQL#23): log exception type only, not full message in investigation.py -- prevents Neo4j URI/credentials leaking into logs

fix(H-08): replace substring audit name match with relationship-based + word-boundary match -- eliminates false positives for common words like 'India', 'National'

fix(H-07,CodeQL#12-17): use file-anchored absolute paths for path traversal guards in dossier_generator and export -- relative realpath() was CWD-dependent

fix(H-06): add lockless pre-check in get_driver() -- prevents lock contention serializing all requests under load

fix(H-05): rate limiter eviction uses ts[0] (oldest) not ts[-1] (newest) -- prevents sliding window bypass attack

fix(H-04): enforce ADMIN_SECRET even when DEBUG_MODE=true -- prevents production DB wipe via accidental debug flag

fix(BUG-C3,C-03,M-13): wrap synchronous Neo4j session in run_in_executor inside async WebSocket; fix feed change-detection to compare full ID set not just first scraped_at

fix(BUG-17): wire blockchain.audit_chain.store_daily_root() to dossier export -- README SHA-256 claim now accurate

fix(NEW-A3 part1): replace em-dashes/smart-quotes in 56+ Python files -- CI requires pure ASCII source

fix(BUG-20): add 30s TTL cache for Neo4j connectivity check -- prevents connection storm on cold start

fix(BUG-15): remove duplicate entity_type param from /search; keep only entity_type_param with alias='type'

fix(BUG-7,NEW-A7): conditionally register /debug/* routes only when DEBUG_MODE=true; bump version to 0.31.3

fix(BUG-6,NEW-A6): add X-Admin-Secret auth on /admin/seed and /admin/pipeline; add threading.Lock for pipeline race condition

fix(BUG-1): use str(depth_safe) literal in Cypher path pattern -- Neo4j rejects parameters in *min..max

fix(encoding): strip non-ASCII from 4 remaining files