v0.9.1

Maintenance + feature release. Resolves #11, #12, #14, #18, #19.

Added

• #11 Force password change on first login — per-user admin toggle, server-enforced (incl. optionalAuth//register), with a forced-change screen.
• #12 Configurable route landing page — Settings → Default Page: built-in branded page (default), custom HTML, or redirect.
• #14 CSV import column auto-mapping — auto-selects fields for common headers; resolves Category/Tags names→IDs (reuse/create), honors a mapped Redirect Code, recognizes existing global/cross-domain IDs.

Changed

• Dashboard restyled with theme CSS variables → consistent dark mode (light mode unchanged).
• Category dropdowns/filters load all categories (not just the first 25).

Fixed

• #18 Only 25 categories were selectable.
• #19 Dark-mode readability (light-on-light callouts/help text).
• CSV import: proper 4xx (not 500) on bad domain; atomic rows (no orphan link on failure); tag dedup; name-length validation.
• Inline regexes broken by template-literal escaping (domain/IP validation, JSON highlighting, geo country detection).

Security

• password_hash, mfa_secret, mfa_backup_codes removed from /users API responses.
• Forced-password-change enforcement uses exact-path matching; security headers applied to public HTML responses.

Verification: 92/92 unit tests, live API E2E, real-browser (Chrome) UI checks, CodeRabbit + Codex review passed.