fix: allow HuggingFace Spaces iframe embedding (cookies, CSP, CSRF)

feat: add first-time setup wizard and zero-config startup

fix(auth): fix HTTP/Tailscale login — opt-in HTTPS redirect, CSP nonce propagation

fix(session-cookie): migrate to __Host- prefix for secure contexts (#294)

fix: allow unauthenticated status health probe for container checks (#295)

security(csp): remove unsafe-inline with nonce-based CSP (#288)

feat(refactor): ready for manual QA after main sync (#274)

fix(security): enforce server-side actor identity (#224)

fix: resolve cron calendar and auth regressions from open issues

feat: add Update Available banner with GitHub release check (#94)