v1.29.2

Version 1.29.2

Security:

- scoreview-engine `v4.7.6-engine.4` on the local path, in the sidecar's
  engine renderer and in the browser fallback. The engine now checks a score
  before MuseScore reads it - nesting depth, staff and segment numbers,
  repeat counts, the version string and the zip structure, with every
  compressed entry unpacked once against its declared size - and refuses a
  file that fails, with the reason in the conversion error. A crafted
  `.mscz` could before crash the converter or keep it busy until the
  timeout. A score can also no longer pick up pictures or text styles from a
  score converted before it in the same process. The pictures of valid
  scores are unchanged (570 scores compared against `v4.7.6-engine.3`), so
  existing conversions are simply redone once with the new engine.

Fixed:

- A delegated administrator (Administration privileges for ScoreView) can
  now use the settings page: its diagnostics, self-test and save requests
  were refused with 403, because the permission attribute was imported from
  a namespace that does not exist and Nextcloud therefore never saw it.
- "My part" is marked again on pages where MuseScore hides an empty staff
  in a system. Staves were matched to parts by their place in the system,
  so one missing staff switched the marking off for the whole page and put
  part stamps and drawings above the system instead; where the picture names its staves (local engine,
  sidecar with the engine), they are now matched by that number.

Changed:

- Score conversions in the background run one at a time, also when several
  cron processes overlap; a local conversion takes 130-250 MB of memory.
- The PHP code is checked with Psalm against Nextcloud 31 and 35 in CI;
  deprecated Nextcloud APIs fail the build.

- Score pages and their timing and metadata go out gzip-compressed when the
  browser accepts it: a page of 174 kB arrives as 22 kB. The stock Apache
  configuration compresses neither SVG nor JSON.
- Status polls queue a pending conversion at most once a minute instead of
  writing to the job table on every poll.
- Requests from the mobile page resolve the score once instead of twice.
- The daily cleanup asks the file cache for all known scores in one query
  and checks only the missing ones one by one.
- Suggestions for a new leader take everyone who already has the score
  mounted without setting up their file system.
- Opening a setlist checks the conversions of all its pieces in one query.
- The Files page loads the HTTP client only when a setlist is opened.
- The practice log starts the week on the first day of the user's locale
  instead of always on Monday, and dates follow the Nextcloud locale.
- Note markers and note texts in the score can be reached and opened with
  the keyboard; panels are named for screen readers.
- Status colours of the tuner needle and shadows follow the theme.