v2.20.0

New Features

• android: tapping an mqvi.net invite or channel link now opens the app instead of the
  browser. Only those two routes are claimed — the landing page, login and the legal pages
  stay on the web, where someone without the app has to land
• voice: turn the phone sideways to watch a screen share full-width. Phones are
  portrait-locked otherwise, and a cinema button next to fullscreen does the rotation
• soundboard: the board now holds the sounds of every server you are in, not just the
  active one. The current server is expanded, the rest are collapsed
• chat: attaching on a touch device now offers camera, gallery or files instead of going
  straight to the file picker
• push: no DM notification when the conversation is already open in front of you, and a
  delivered notification is pulled back off the tray once you read it on another device
• dm: read state syncs across your devices, so a conversation read on the desktop stops
  showing as unread on the phone
• auth: passwords are checked against known breaches and a minimum length at every entry
  point — registration, reset and change
• settings: settings open as a full-screen sheet with a real toolbar on mobile, and help
  articles drill in one column at a time
• auth: logging out asks for confirmation first, and can be reached from the profile card

Bug Fixes

• dm: DM read state and notification dismissal never worked on Android. The read loop was
  trusting document.hasFocus() and the WebView's visibility state, neither of which reflects
  whether the phone is actually in front of you; it now asks the native app state
• dm: a message sent in the same second as the last read one could be lost, and read
  history could resurface as unread
• dm: the client could claim to have read messages it never rendered
• calls: a call is owned by the connection and device that made it, so answering on one
  device stops the others ringing, and a socket blip no longer hangs up a live call
• chat: messages that arrived while the app was backgrounded are recovered on resume
• chat: a video attachment shows a preview frame on mobile instead of a broken box
• soundboard: permission is checked against the channel the sound plays into, and the
  popup no longer overflows the screen on mobile
• android: the header no longer slides under the status bar
• discovery: the server card shows the banner the owner actually cropped
• cleanup: the orphan sweep no longer deletes files whose reference source it does not
  know about — an unregistered upload kind now costs disk, never data
• settings: opening settings on mobile lands on the nav, not on Profile; the roles panel
  no longer opens on the owner
• auth: the language chosen at registration is persisted to the account
• ui: the boot spinner actually renders
• deploy: the deploy script no longer kills the shell running it, backs the database up
  first, and waits for readiness before calling a deploy done

Refactoring

• push: a DM read is proved against the server-side watermark instead of being taken on
  the client's word