v1.10.0

Added

• The Collection search announces its result count to screen readers, which previously had no feedback that the grid had updated.

Fixed

• API error responses now use the documented shape (VALIDATION_ERROR, error codes) instead of leaking technical messages. Client errors (4xx) are logged as warnings, keeping the error level for real server faults.
• Offline support no longer breaks silently when a single asset fails to precache: the Service Worker caches each shell file individually and logs what failed.
• "Reset my data" no longer discards the cached deck version, which forced a needless full deck re-download on the next load.
• A SESSION_SECRET containing multi-byte characters (accents, emoji) in its first 32 characters no longer crashes the server at startup.
• The client no longer announces a clean sync when the history upload fails: the entries stay queued and retry on the next online event.
• Failed login attempts are now counted atomically, so simultaneous wrong-password attempts can no longer under-count and delay the account lockout.
• The PWA manifest response now sends Vary: Accept-Language, so a shared cache (reverse proxy, CDN) can no longer serve one visitor's localized manifest to everyone.
• The Settings screen no longer accumulates install-prompt listeners across repeat visits.

Changed

• The Collection search waits 150 ms after the last keystroke before re-rendering the grid, sparing low-end phones a full rebuild per typed letter.
• Docker images are now built with npm ci against the committed lockfiles, so every build of a given commit ships the exact dependency versions that were tested. The container healthcheck uses Node's built-in fetch instead of shipping wget.