Open Matte 1.0.2

Security fixes, TMDB's credit, and fixes to the admin and the film pages.

Security

• Nobody can probe which films a cinema holds. A refused request for a film's artwork now answers exactly as a film that doesn't exist does, and the same goes for Keep it. Before, a stranger who guessed a film's address could tell the two apart, unpublished films included.
• Limits: missed artwork requests are limited per address and per IPv6 /48, refused requests can no longer flood the server's log, and admin sign-in is also limited per IPv6 /48. There is deliberately no limit across all addresses, so nobody can lock you out of your own admin.
• One browser can no longer hold every poster download place.

TMDB

If you use a TMDB key, every page now shows TMDB's logo and the notice its terms require, and keeps them while anything from TMDB is on show, even after you remove the key. docs/metadata.md says what TMDB's terms ask of you: a free key is for non-commercial use only. The logo is TMDB's trademark and isn't covered by the GPL.

Fixes

• On a phone, every admin tab can be reached. Cards side by side line up, and Films stays marked on a film's page.
• Keyboard focus is visible everywhere. Times no longer show a stray leading zero, and never split before AM or PM.
• Faint text, such as hints and table headings, is easier to read.
• The README and the guides: upload speeds, storage (up to about 38 GB for a two-hour 4K HDR film), and what a backup holds.

Updating

Back up first, then update as usual (docs/deploying.md). If you chose your own background colour, read the Upgrading note in the changelog: it may be refused the next time you change your colours. Going back to 1.0.1 needs no restore.