1.9.2 — the checkbox shortcut, and backups off the public repo

The checkbox shortcut works on the devices it is used on, and the backups are not on a
public repository any more.

Fixed

• -- did not become a checkbox on a Mac or an iPhone, and had not since 1.0.0
  (#242). Autocorrect is on in the editing surface deliberately — ADR-003 §6, restored in
  #112 when CodeMirror arrived — and Apple's autocorrect includes smart dashes, which
  rewrite two hyphens into – or — while you type. The space landed after the hyphens
  were already gone, so a shorthand matching a literal -- never fired. It now accepts
  what the platform actually produces, and takes the caret offset from the match's own
  width rather than a constant, because — is two characters where -- is three.

  🔴 No browser test can cover this and none was written. Substitution happens in the
  OS input stack, above WebKit — Playwright types characters straight into the page, so a
  browser test types a literal -- forever and would agree with the bug. Found from use,
  seven months of releases after it broke.

• 🔴 Production backups were being written to a public repository. Every prod deploy
  since 2026-08-18 uploaded a cleartext dump of every page belonging to every person using
  the deployment as a GitHub Actions artifact, and the scheduled backup added one
  nightly. The artifact list is readable with no authentication at all, and downloading
  needs only read access to a repo that grants it to everyone. Twenty-eight dumps were
  live; they were retrieved and deleted, and both workflows now write to a private R2
  bucket in the production account.

  R2 rather than anywhere else for a reason beyond privacy: it is what lets a laptop hold
  a copy without holding a dangerous credential. wrangler d1 export is a POST that
  creates a job, so pulling a backup straight out of D1 needs D1: Edit on production.
  Reading an object needs R2: Read, which can do nothing but read. The job writes;
  make backup-pull reads.

• The Quick start did not reach a logged-in app. pnpm dev passed no
  KNAG_OPERATOR_EMAIL, so a fresh clone got a running Worker and a login screen it could
  not pass.

• Documentation that had become wrong, found by an audit of the repo as a public
  project: the README described one page and no history pane; docs/deployment.md omitted
  the two zone-scoped permissions the prod token needs — which fails a deploy after the
  migrations have applied — and still described production as unprovisioned; the Makefile
  said destructive changes take two releases where ADR-002 §3 says three; ADR-005 gated
  consent on a passphrase that no longer exists and named an endpoint path that returns
  the PWA shell. Two references to a private sibling repository, missed by an earlier
  sweep, are gone.

Added

• A scheduled production backup (#233) — nightly, to R2, failing on an empty export
  rather than going green with a schema and no rows.
• make backup-pull — fetch a production backup onto this machine with a read-only
  token.
• Two README sections a hosted person needs: how to host knag for other people — the
  seven things a fork must replace, including the KV namespace no document mentioned — and
  what the operator can see, which says the thing the admin view's no page content, ever
  does not: the operator holds the database, and every backup is a plain dump of everyone's
  pages.
• What actually protects the data, in docs/deployment.md. 🔴 Including the number
  that was wrong everywhere: D1 Time Travel is 7 days on the free plan, not 30, so
  everything older than a week rests entirely on the backup.

Full changelog: v1.9.1...v1.9.2