v1.2.2 - Safe Conditional Trade Confirmation

Highlights

• Added per-account trade confirmation modes: manual review, confirm all, and incoming items only.
• Incoming-items mode fails closed: a trade is confirmed only when Steam explicitly reports no outgoing assets and at least one incoming asset.
• Trade and login auto-confirm controls remain independent.

Security and Reliability

• Added CSP and webhook SSRF hardening.
• Updated runtime dependencies; production dependency audits are clean.
• Removed an unused PWA asset generator that could make CI flaky through Sharp/libvips downloads.
• Replaced secret-like test fixtures so secret scanning remains enabled and actionable.

Verification

• Backend: build, lint, and 94 tests passed.
• Frontend: build, lint, and unit tests passed.
• GitHub Actions CI is green across backend, frontend, audits, and secret scanning.