v0.1.1 — first-deployment fixes and a security review

Missivus sends all Matomo email — password resets, scheduled report PDFs, alerts — through the
Microsoft Graph API, using OAuth2 client credentials, the Mail.Send application permission, and
one shared mailbox. No user login, no delegated OAuth, no SMTP.

This release is the first round of fixes after a real deployment, plus a security review.

Fixed

• The "Send test email" button no longer lies about being ready. The test sends with the
  saved settings, so filling the form in and clicking the button used to report that Missivus was
  switched off. The button now stays disabled until the stored configuration can actually send,
  names what is missing, and re-checks itself when a save completes — no page reload.
• The result box is readable in the dark theme. It set a background colour but not a foreground
  one, so the Graph error — the one thing worth reading — was light text on a light panel. It now
  uses Matomo's own notification / notification-success / notification-error /
  notification-info classes.
• A network failure while uploading a large attachment escaped as an unhandled exception, skipping
  the fallback setting and writing a pre-authenticated upload URL to the log. It is now a normal,
  redacted transport failure.

Security

A full audit of the transport, settings, API method and Vue component is published as
docs/SECURITY.md
— including the three risks that were accepted rather than eliminated, with the reasoning.

• A graph_base_url / login_base_url override is refused unless it is a bare https origin, so a
  mis-set or hostile value can no longer send a client secret or a bearer token in clear text
  somewhere else.
• uploadUrl values are redacted, because a pre-authenticated URL is itself a credential.
• Every setting is validated on entry.
• Missivus.sendTestEmail validates the recipient and refuses anything but an HTTP POST; the
  recipient now travels in the request body rather than the query string.
• Verified clean: secrets never reach the page source, the API response or the browser console;
  both API methods are superuser-gated; Graph error bodies are shown to superusers only; and a
  cross-site call cannot authenticate, because Matomo does not accept the session cookie for
  module=API requests.

Docs

docs/INSTALL.md Part 6 gains Upload via the Matomo UI (Docker or locked-down installs): why
enable_plugin_upload ships off, how to turn it on from the console or inside a container, the
upload and activate steps, and the command to close it again afterwards. The shell route remains
the recommended one.

Install

Download Missivus-0.1.1.zip below and unzip it into plugins/, or upload it through
Administration → Platform → Plugins → Install a new plugin, then
./console plugin:activate Missivus. The Microsoft-side setup — app registration, Mail.Send
application permission, shared mailbox, and the Exchange application access policy that scopes the
app to that one mailbox — is written for a non-expert in
docs/INSTALL.md.

Requires Matomo 5.x and PHP 7.2.5+. Lint clean and 60 unit tests passing on both PHP 7.2.34 and
PHP 8.5.9.