OpenClear 1.11.0

Settings you can see at a glance, reminders before the cutoff, security events delivered to
a bank's SIEM, and uploads in a customer's own format. It brings:

• one control panel for Settings and Admin, at bank and customer level;
• email and text reminders before each cutoff, with bank timing and a customer override;
• security events delivered to syslog, Splunk HEC or HTTPS, checked against a real Splunk
  and syslog-ng, with a control that fails when delivery falls behind;
• issue-file layouts built from a sample file, and failed rows fixed in the browser;
• drag and drop on every upload page, and fixes for pages that scrolled sideways on phones.

Control panel, reminders and event shipping (MASTER_PLAN.md M4)

• Settings is one control panel. Settings and Admin are now one page of tiles, in five
  sections, each tile showing how its setting stands ("Dual control · On", "Controls · 1
  WARN"), with a search box. A person sees only the tiles their permissions allow.
  • Small settings open in a dialog with its own URL (/ui/settings/branding), so it can
    be bookmarked or linked; without JavaScript it's a plain page. Back closes it, focus
    returns to the tile, closing with unsaved changes asks first, saving updates the tile
    in place, and errors show in the dialog. It's full-screen on phones.
  • Lists and workflows (users, SSO, webhooks, controls…) open as pages with "Back to
    settings", which returns to their tile with the search kept.
  • A business customer's own users get their customer's panel: reminders, banner and
    billing statement.
  • /ui/admin redirects to the panel; the ML models page is now /ui/admin/ml-models.
• Reminders before the cutoff. Everyone who can recommend or decide an exception gets one
  message per reminder, "N items to decide, due in X", by email or text per their
  notification preferences. Timing per bank (Settings → Reminders; 2 hours and 30 minutes
  before by default, OPENCLEAR_REMINDER_OFFSETS_MINUTES), with a customer override.
• Check return reasons have their own settings page: add, edit, retire and restore,
  with their X9.100-188 codes. ach_return_reason:manage now covers both lists.
• Security events delivered to a SIEM. Syslog (RFC 5424 over TLS, as JSON, CEF or LEEF),
  Splunk HTTP Event Collector (with indexer acknowledgement) and HTTPS JSON. Each bank adds
  its own destination in Settings → Security event forwarding, with a test event; the
  operator can set one for the whole installation (OPENCLEAR_SIEM_*). Delivery is in
  order and at least once from a cursor, with backoff and catch-up, and never slows a
  request (OPENCLEAR_ENABLE_SECURITY_EVENT_DELIVERY_SCHEDULER). Events a destination
  hasn't received are kept past their retention until it has.
  TLS syslog is octet-counted (RFC 5425), plain TCP one message per line. Checked against
  real Splunk (HEC with acknowledgement, and its TCP syslog input) and a syslog-ng relay.
• A new control, "Security events delivered": it fails when a destination has been
  failing for an hour or falls behind, and warns when there's no destination and nobody has
  read the pull API for a day. The evidence export adds the period's event counts by
  category and each destination's delivery record.
• New security events: webhook.changed, users.exported, secrets.reencrypted and
  security_events.destination.changed.
• Docs: a SIEM guide (docs/guides/siem.md) for Splunk, Sentinel, QRadar, Elastic and a
  syslog relay, with suggested detections; a log-management row in the FFIEC crosswalk.
• Fixes:
  • Sortable table headers are now real buttons inside the column header (axe flagged
    aria-sort on role="button").
  • The scheduler now starts when only the decision outbox or control tests are turned on.
• Migration d1f3b5d7f9a2: reminder timing on banks and customers,
  deadline_reminder, and security_event_destination.

Uploads (MASTER_PLAN.md M5)

• Issue-file layouts. A customer's issued-check files in their own format: delimited (any
  delimiter, with or without a header, columns by name or position), fixed-width (start and
  length per field, a record prefix, header and trailer lines skipped) or Excel. Amounts
  with a decimal point, implied cents or a separate cents column; named date formats; a void
  flag (a void line voids the check already issued); leading zeros dropped if asked.
  • Built from a sample in Settings → Issue-file layouts: choose what each column holds above
    the sample's first rows, or select a fixed-width field's characters; preview what would
    be imported, errors included, before saving. A short library of common shapes to start
    from. Bank-wide or per customer, with a default.
  • Used by the upload page, the API (format=layout, layout_id;
    GET /api/v1/bulk-uploads/layouts) and the drop folder (the default). Each upload keeps
    a copy of the layout it used.
  • A file whose columns don't match offers "Save these settings as a layout", starting from it.
• Fixing failed rows in the browser. Each failed row names the field at fault. "Fix
  failed rows" shows them editable, with the error beside the field; only the ticked rows are
  imported, each recorded as a correction with who made it, in the action log, and reversed
  by backing the upload out. The uploaded file never changes.
• Drag and drop onto every upload page's file input.
• Fixes: a wide table inside a form, or a visually hidden label in a table header, no
  longer widens the page on a phone.
• Migration e2a4c6e8a0b3: import_layout, bulk_upload_correction, and the failed
  field on row results.