v0.1.74

Frontend — 3 of 62 confirmed findings (14-16 of 62) — campaign complete

Re-derived from current code by a fresh investigation fork. Bundled into one PR since all three are small and land in the same subsystem — the last one in this 62-finding whole-project review campaign.

Numeric fields in modalForm had no native HTML5 validation

The generic field renderer never emitted type/min/max. Confirmed affected: editProvider's max_concurrency and all 5 numeric fields in editPrice. This is the frontend counterpart of an Admin API backend bug fixed earlier this campaign (negative max_concurrency silently became "unlimited", now a 400): the backend rejects it, but the form gave zero client-side signal. Added a type:"number" branch with min/max/step, extracted the whole field renderer into its own renderFormField function (same reason staleGuard already is one) for testability.

Copy-token button had no clipboard failure handling

navigator.clipboard is genuinely undefined on a plain-HTTP origin (TLS is opt-in here, not default) — confirmed live. Added a guard plus .catch(), both showing a clear toast.

"Import prices" silently no-op'd with zero providers configured

Now shows a toast naming the reason.

• Test: renderformfield.test.mjs (new, 4 unit tests, mirrors staleguard.test.mjs)
• Surgical-revert proof: disabling the new branch fails 1 of 6 total JS tests
• Live-verified against the running dev stack with a real browser (Playwright + system Chrome): navigator.clipboard confirmed undefined on this deployment's actual non-localhost HTTP origin, the fallback toast fired exactly as designed; typing -1 into max_concurrency and clicking Save is genuinely blocked by the browser's own native constraint validation, modal stays open.

Shipped via #151, chart bump #152.

---

🎉 Campaign complete: all 62 confirmed findings fixed

This release closes the whole-project review campaign started earlier this session: 10 Critical + 26 Important + every re-derived Minor finding across all 8 subsystems (Auth, DLP/capture, Protocol translation, Limits/pricing, Admin API, Store/config, Routing/fallback, Frontend) — all fixed, tested with a real failing-then-passing proof, surgical-revert-verified, and shipped through the full branch → PR → CI → merge → chart bump → tag → release → image-verification pipeline, one finding (or small same-subsystem batch) at a time, from v0.1.48 through this release.

Full Changelog: v0.1.73...v0.1.74