v1.5.5

Corrections from an independent, fresh-context review of v1.5.4 — run precisely to catch what the authors of a release cannot see in their own work. It caught one real regression, confirmed live before the fix shipped. If you deploy with docker compose, take this release.

Fixed

• v1.5.4's docker-compose.yml silently disabled scheduled backups. The new env passthrough rendered an absent BACKUP_INTERVAL_HOURS as an empty string — set, but empty — and the schedule guard's !== undefined check read that as an explicit 0: disabled. Any Compose user upgrading through v1.5.4 lost the default 24-hour snapshots without a word. Empty now means unset; only an explicit 0 disables. All eight forwarded variables were audited for the same trap (this was the only one), and a regression test pins the exact empty-string shape Compose sends. Users of the prebuilt ghcr.io image or plain docker run were never affected — the bug lived in the compose file, not the image.
• Seeding a brand-new data directory failed with "no such table: contacts". The seed scripts now use the server's own database module, which runs migrations on import. Verified: fresh empty DATA_DIR → first run inserts, second run skips.
• The SSRF guard missed private addresses wrapped in IPv6. ::ffff:169.254.169.254 (cloud metadata), CGNAT, 172.16/12, and NAT64 wrappings all walked past the three hardcoded prefixes it knew. Any IPv6 address embedding an IPv4 — dotted or hex-group form — is now judged by the full IPv4 policy, with block and pass cases pinned in tests. The gap predates v1.5.4, but the connect-time DNS-rebinding guard added there leans on this function, so it earned the hardening.
• The one stale doc line the docs audit missed: the scripts table no longer claims npm run seed clears the database (it inserts one contact and deletes nothing).

533 tests (15 new), zero lint findings.

---

Full changelog: v1.5.4...v1.5.5