v2.72.0

Self-hosted ZenNotes server 2.72.0 with the pinned browser artifact web-2.72.0-web.habddb79fb3c63358 (built from ZenNotes/zennotes 3792c985, the v2.72.0 release commit).

What changed for self-hosters:

• Task folders (ZenNotes/zennotes#962). A vault's Task folders narrow Tasks to the notes inside the folders they name, and every other checkbox stays a plain checkbox; the excluded folders still apply inside them. In the browser app, right-click a folder and choose Use as Task Folder, or edit both lists under Settings, Tasks, Checklists. The server reads the new tasks.includedFolders in .zennotes/vault.json for /api/tasks and /api/tasks/for, keeps it through a settings write, moves both lists with a renamed folder, and ?includeExcluded=1 still lists everything. Its task walk now checks the lists before reading a file, so a vault with Task folders opens only what it lists.
• Cloud errors you can act on, for a browser app linked to ZenNotes Cloud: every Cloud failure now says what happened and what to do, with a Details disclosure holding the technical line.
• The icon and color pickers take the keyboard (ZenNotes/zennotes#960), and panel keys and note shortcuts wait while any dialog is open.
• Blocks opened in a quote or callout stay in it (ZenNotes/zennotes#961), including Enter on a code line inside a quoted fence.
• A pasted screenshot is named for when you pasted it (ZenNotes/zennotes#775), instead of image.png, image 2.png and on.

The desktop-only items of 2.72.0 (the bundled zn 0.9.0, and the input-method guard in the desktop's extra windows) do not apply to the browser app. The server's Go change is the Task folders rule (34da661); no route, header or Go dependency changed, so vendorHash stays.

Verification before publication: prepare-web installed the artifact archive into a clean web/dist and verified every file (580), and its SHA-256 matches its provenance; go vet, go test ./... and go test -tags=embed_web ./... pass; a server built like the release, with a scratch config and vault, reported v2.72.0, served the app, answered 401 without the token, and with tasks.includedFolders set to one folder listed only that folder's task. CI passed on #36 (10 of 10). Every released binary matches SHA256SUMS, and the manifest asset is the committed pin byte for byte; with a scratch config and vault, the released darwin-arm64 binary reported v2.72.0, served the app, answered 401 without the token, listed only the Task folder's task, listed both with ?includeExcluded=1, and served a bundle carrying Use as Task Folder.

Docker: adibhanna/zennotes:2.72.0, 2.72 and latest are published from this tag by the repository's Docker publisher (linux/amd64 and linux/arm64, one digest).