v2.0.0

v2.0.0

A major milestone release — the webui and app now share data properly
instead of drifting apart, and a real security gap found during a full
code review is closed.

New

• Shop colours now genuinely match the app instead of two independent
  hashes disagreeing - the webui sends its own colour mapping via sync,
  the app uses it directly.
• The configured shipping-estimate default is now shared with the app
  the same way, instead of being hardcoded separately on each side.
• Total/Comics/Shipping toggles, previously Dashboard-only, now also on
  Insights' 12-month trend chart.
• Cumulative spend curve and price distribution chart on Insights.
• Calendar heatmap - days shade by how much is actually due.
• "Biggest still to come" card on the dashboard.
• Delay this item - one tap (+30/+60/+90 days) for a manufacturer delay.
• Whatnot order confirmation email support.
• Close buttons on the item edit and import review screens.

Fixed

• A critical data-loss bug where syncing an item from the app could
  silently wipe that item's note on the webui.
• CSV exports had no protection against formula/CSV injection.
• Webui and app sometimes disagreeing on which items show in "coming
  up" or "10 most recent" when several release the same day.
• The Insights cumulative-spend chart showing all three lines at once
  instead of just Total.
• Budget circle showing a capped "100%" instead of the true percentage
  over budget.
• A database-locked error during a large first-time app sync.

Full changelog in commit history.