ValuSafe 4.5.2

Security release. Recommended for all installations.

• Two-factor login: TOTP codes can no longer be brute-forced (lockout after repeated failures).
• Password reset links now use a fixed address (APP_URL in config.php) instead of the request's Host header. Without APP_URL, reset by e-mail is disabled.
• Book cover lookup only passes through real images.
• Receipts can only be deleted via the delete button (POST + token), no longer via a crafted link.
• The backups/ and logs/ folders ship with access protection.
• Room management: names with an apostrophe can be deleted again; dialogs work with the keyboard and focus "Cancel".

Updating from 4.5.1: copy the new files over the old ones (config.php, upload/, documents/, backups/ stay), then add
define('APP_URL', 'https://your.address');
to config.php (no trailing slash), and delete components/mobile_items_cards.php.

Full list: CHANGELOG.md
SHA-256 (ZIP): efb782af455dff381e21efcc72749c75e2758cbbdadaefcf1f05ffa0173df620