Nexview 0.26.0

New

• One account nobody else can throw out. Until now every administrator was equal, so
  appointing a second one also handed them the power to remove the first: switch the
  account off, demote it, or simply set a new password and become them. Exactly one
  account now carries an Owner badge in Settings → Users. It grants its holder
  nothing; it only says what others may not do with that account, and the buttons that
  would have done it are greyed out with a sentence saying why. Handing it on is the
  owner's alone, under Profile → Security, and there is no way back. If you ever lock
  yourself out, NEXVIEW_BETREIBER=<username> at startup puts the flag back.

• House rules: your own text, if you want one. What may be requested, how long titles
  stay, who to write to when something is broken. You can write it down under
  Settings → House rules instead of explaining it once in a message nobody finds again.
  A toolbar, images, and the finished page rendered live beside the editor. Everyone else
  reaches it through a § button in the bottom right corner, with a dot on it until
  they have read the current version. Entirely optional: leave it empty and there is no
  button either.

Fixed

Sign-in through a provider got a full pass. If you run authentik, Keycloak, Authelia,
Zitadel or Pocket ID, this release is worth taking.

• Two kinds of provider could never sign in at all. ES512 and Ed25519 signatures were
  rejected (Pocket ID offers both), and a signed userinfo response, which Authelia and
  Zitadel can return, was silently discarded. Anyone in either group got "the provider's
  identity token could not be verified" on every attempt, with nothing in the log pointing
  at the reason. Both work now.

• A stranger could lock every user out. The sign-in throttle counted per provider
  rather than per person: ten failed callbacks from any browser, no account and no password
  needed, and nobody could use that provider for fifteen minutes, repeatable
  indefinitely. The same thing happened by accident after a mistyped client secret.

• The lock-out guard had three side doors. Deleting a provider is refused when
  accounts would lose their only way in. Switching it off, changing its address, or
  replacing its credentials did the same damage and went straight through, and a link to
  a provider that had since been deleted or switched off counted as a way in, which made
  the guard fall silent entirely for the affected accounts.

• Three more holes, all closed: the sign-in cookie carried no Secure and
  NEXVIEW_COOKIE_SECURE never reached it; a confirmation from userinfo could vouch for
  a different address than the one being used; and an identity token issued for a
  different application was accepted because azp was not checked.

• A refused sign-in now says why. It used to say nothing at all: the person got a
  deliberately vague message and the log stayed silent, so an operator whose provider
  reports email_verified: false (the factory setting at authentik, Keycloak and
  Pocket ID) had nothing to go on. Every refusal now names the reason, the issuer, whether
  an address arrived and whether an account exists for it, with addresses shortened.

• A provider can be corrected in the interface. Until now a mistyped client secret
  could only be fixed by deleting the provider and adding it again.

Children's wishes and requests

• A child's wish could only be declined once the film had already arrived, the one
  answer that tells the child the opposite of the truth. Such a wish is now closed as
  fulfilled. Wishes whose film arrived through somebody else's request no longer stay open
  forever, and deleting a child account no longer leaves its wishes behind.

• Approving a film that Radarr already held failed for good, a failed request had no
  button left at all, and two messages arrived in German regardless of the language you
  had set.

Changed

• The approval list says which child a request came from.
• "Searching for over 14 days" no longer reports films that have not come out yet.
• The "test phase" notice above the storage quotas is gone.

Under the hood

• The first visit is 47 kB lighter.
• The README now documents the email_verified trap, Authelia and Zitadel, what Nexview
  reads from a token, and that groups are deliberately ignored.