v1.3.2-beta.9

[1.3.2-beta.9] - 2026-10-24

Bug Fixes

• Drop unused SQL parameters after visibility rework by @John710
  Postgres errors with 42P18 when a bound parameter is never referenced
  (net-worth passed userId as $1 that the query no longer used). Visible
  account arrays are now $1 everywhere and filter placeholders start at $2;
  the same latent collision in the report helpers is fixed too.
• Transactions list param order broke visibility scoping by @John710
  The list query passed userId as $1 while the WHERE clause expected the
  visible-account array — every list came back empty (caught by the
  blackbox suite's paired-leg check).

CI/CD

• Dump app container logs when blackbox fails by @John710

Features

• Family sharing on entity level, admin user management by @John710

Testing

• Dump raw net-worth response on failure by @John710- Tighter pacing thresholds + GET-only 429 retry by @John710
  The server limiter uses fixed windows — a rolling 25/min burst can
  straddle two windows and still exceed 30. Thresholds 12/60 keep worst-case
  straddles under both limits; stray GET 429s (outside /auth) retry once.
• Pace GET and non-GET blackbox requests against separate limits by @John710- Pace blackbox requests instead of retrying 429s by @John710
  A rolling-window pacifier keeps non-auth requests under the 100/min GET
  limit (the report burst tripped it and net-worth read a 429 error body
  as an empty series). Auth requests stay bursty so the rate-limit test
  still observes its expected 429.
• Retry 429 in blackbox for GET requests too by @John710
  The report burst can exceed the 100/min GET limit mid-suite; the net-worth
  assert read a 429 error body as an empty series (got=undefined) and failed
  non-deterministically in CI. All methods now wait out the window and retry.

Full Changelog: v1.3.1...v1.3.2-beta.9