v1.0.0

What's Changed

• Slice 1: Solution & Docker Scaffolding by @rghvgrv in #24
• Security: hard-stop secret scanning via git hooks by @rghvgrv in #25
• Slice 2: Schema — Users, Categories, Payment Sources by @rghvgrv in #26
• Slice 3: Schema — Subscription Catalog (pgvector + HNSW) by @rghvgrv in #27
• Slice 4: Schema — User Subscriptions by @rghvgrv in #28
• Slice 5: Schema — FX Rates + Refresh Tokens by @rghvgrv in #29
• Slice 6: Schema — Notifications Log by @rghvgrv in #30
• Slice 7: Auth — Register + Login (JWT issue) by @rghvgrv in #31
• Slice 8: Auth — Refresh Token Rotation + Reuse Detection by @rghvgrv in #32
• Slice 9: Auth — Logout (Revoke Refresh Token) by @rghvgrv in #33
• Slice 10: Subscriptions — Create by @rghvgrv in #34
• Land Slices 11-13 into main (stacked-PR base gap) by @rghvgrv in #36
• Slice 14: Categories — List + Create by @rghvgrv in #37
• Slice 15: Payment Sources — List + Create + Delete by @rghvgrv in #38
• Slices 16-17: Burn Rate Core + FX Rate Daily Refresh Job (combined, fixes #39 conflict) by @rghvgrv in #41
• Slice 18: Multi-Currency — Apply Conversion to Burn Rate by @rghvgrv in #42
• Slices 19-22: Category Breakdown, AI Resolve, Rate Limiting, Renewal Alerts by @rghvgrv in #43
• Backend hardening: exception handling, auth rate limiting, device tokens, health check, logging, CI (#61-#66) by @rghvgrv in #71
• Backend hardening: password reset flow, FCM push delivery, docs sync (#67-#70) by @rghvgrv in #72
• Backend user profile endpoint + Mobile client foundation (#45-#51) by @rghvgrv in #73
• Subscription CRUD + cross-cutting mobile hardening (#52-#59) by @rghvgrv in #74
• fix: repair CI broken by mobile test project's Windows-only TFM by @rghvgrv in #75
• Catalog seed + embeddings, CatalogId end-to-end, renewal-date advancement (#77-#81) by @rghvgrv in #92
• List logo + trial badge, global alert-days default, soft deactivation, targeted renewal scan (#82-#85, #88) by @rghvgrv in #93
• Pin the renewal scan to a fixed UTC hour, fail fast on blank secrets, drop scaffolding (#89-#91) by @rghvgrv in #94
• fix: close five session, privacy and honesty gaps found in audit (#95-#99) by @rghvgrv in #104
• fix: pin the FX schedule, retry the backfill, tighten config, unhardcode the API host (#100-#103) by @rghvgrv in #105
• Mobile: register the device push token after login (#87) by @rghvgrv in #106
• Match providers with pg_trgm instead of OpenAI embeddings by @rghvgrv in #107
• Always-visible burn-rate banner that follows the user's edits by @rghvgrv in #108
• Catalog in JSON: add a brand in one line, plus 39 new providers by @rghvgrv in #109
• Schedule renewal reminders on-device instead of pushing them by @rghvgrv in #110
• Close five account-enumeration and token-rotation holes in auth by @rghvgrv in #111
• Read Docker secrets from a mounted appsettings file, not the environment by @rghvgrv in #112
• One local config file for both dotnet run and Docker by @rghvgrv in #113
• feat: default new users to INR instead of USD by @rghvgrv in #114
• fix(mobile): two launch-blocking crashes, plus a UI pass and device docs by @rghvgrv in #115
• feat(mobile+api): payment tracking with overdue state, grouped subscriptions list, icon and delete fixes by @rghvgrv in #116
• feat: payment tracking with overdue state, plus UI pass, theme choice and docs trim by @rghvgrv in #117
• feat: deployable API + signed Android release on free infrastructure by @rghvgrv in #118
• Cross-user reference fix, request logging, credential cleanup and migration drift guard by @rghvgrv in #129
• fix(mobile): show the offline message instead of crashing when the API is unreachable by @rghvgrv in #131
• Sequence migrations ahead of deploy, plus four cleanups by @rghvgrv in #132
• Index the refresh-token lookup, split health checks, add mobile timeouts and validation bounds by @rghvgrv in #139
• Batch FX lookups, guard subscription updates with a concurrency token by @rghvgrv in #140
• feat(mobile): Material iconography, icon tiles and a rebuilt dashboard by @rghvgrv in #141
• Account recovery: password reset reachable from the app, plus change-password by @rghvgrv in #148
• Category rename/delete, payment-source rename, subscription currency picker by @rghvgrv in #149
• docs: record that offline writes are out of scope by @rghvgrv in #150
• App icon of our own, and a provider match that suggests instead of overwrites by @rghvgrv in #151
• fix(mobile): describe one-time reminders as payments by @floze-the-genius in #156
• Close the subscription list's offline write hole, and stop four catch blocks hiding defects by @rghvgrv in #157
• Cut the dead weight the repo audit found: -1 dependency, -7 files, no behaviour change by @rghvgrv in #163
• Correct the deploy runbook against a real first deploy by @rghvgrv in #168
• Make Android signing failures say what is wrong, and build Android on PRs by @rghvgrv in #169

New Contributors

• @floze-the-genius made their first contribution in #156

Full Changelog: https://github.com/Splitzzyy/Subvora/commits/v1.0.0