v1.0.10

Highlights

• #9 Project permissions (PR #52): per-project roles (Read-only / Read & Write / Admin), a project Members management UI (add/change-role/remove with user search), and read-only enforcement server- and client-side. Owner is protected as implicit admin. No DB migration.

Hardening & fixes

• H1 (PR #51): nginx serves index.html with Cache-Control: no-cache so deploys pick up fresh asset hashes without a manual hard-reload.
• H2 / H3 (PR #50): notification-prefs no longer leaks enum names on an unknown type (400); changePassword/register reject all-whitespace passwords.
• #12 (PR #49): Dependabot alerts cleared (logback-core 1.5.35, commons-compress 1.26.0).
• #11 (PR #48): sidebar pinned to viewport height so Logout stays reachable on long pages.