DarkRoomLibrary v1.2.4

This patch release freezes the verified v1.2.x backend and database boundary while strengthening public delivery evidence.

Changes

Updated the locked nanoid transitive dependency to address GHSA-2v37-7h3g-55p8.
Fixed the local browser workflow by routing development API requests through the Vite same-origin proxy instead of weakening CSP.
Added independent CodeQL, dependency review, and npm audit security gates.
Added repository architecture and release-version checks to CI.
Added a tag-gated release workflow that reruns CI, requires a successful Security run on the same commit, and verifies main ancestry.
Added reproducible ZIP, SHA-256, manifest, and SPDX SBOM release assets.
Increased the Pages deployment wait boundary after GitHub timed out while the deployment remained in progress.

Backend: 282 tests, no failures, errors, or skips; 70% line-coverage gate passed.
Frontend: 68 critical-logic tests, ESLint, production build, demo build, and high-severity npm audit passed.
Six fixed identities completed 70 real page API responses across borrowing, permissions, procurement, logistics, and warehouse intake.
Redis and RabbitMQ each passed available and unavailable/degraded checks without blocking database-backed core operations.
The 20-scenario concurrency suite passed 393 requests; browser diagnostics passed 116 routes, 456 API responses, and 6,114 network responses with no reported runtime, network, or layout errors.
The three-instance 8-scenario/176-request result remains explicitly dated 2026-08-02; it was not rerun on the 16 GB host during this patch acceptance.