v1.0.0

What's Changed

• Phase 0: Projektstruktur & Governance by @bigpuritz in #2
• chore: project governance & tooling (CLA, Renovate, copyright headers, branch-protection ADR) by @bigpuritz in #4
• docs: correct ADR-0016 — CLA_TOKEN optional, document cla-signatures bootstrap by @bigpuritz in #6
• feat: bootable Spring Boot server (qnop-app) with PostgreSQL, Liquibase and JPA by @bigpuritz in #24
• feat: OpenAPI-first REST contract tooling in qnop-api (#9) by @devtank42 in #26
• feat: security & crypto foundation (SecurityConfig, crypto, QnopProperties) by @devtank42 in #25
• feat: identity schema (qnop_user, oidc_provider, oidc_identity) by @devtank42 in #27
• feat: settings schema (application_setting + user_setting + seed) by @devtank42 in #28
• feat: mail template schema (mail_template + en seed) by @devtank42 in #29
• feat: application asset schema (application_asset) by @devtank42 in #31
• feat: token schema (refresh/revoked/email-verification/password-reset) (#12) by @devtank42 in #30
• feat: application settings service + admin endpoints by @devtank42 in #32
• feat: JWT & session core (access/refresh tokens, revocation, AuthController) by @devtank42 in #33
• feat: auth endpoint rate limiting (Bucket4j) by @devtank42 in #34
• feat: mail subsystem — runtime SMTP, jmustache templates, admin endpoints (#19) by @devtank42 in #35
• feat: per-user settings service + /users/me/settings by @devtank42 in #37
• feat: local-user lifecycle core — registration, verification, password reset (Part of #20) by @devtank42 in #38
• feat: OIDC provider admin + SSRF guard (Part of #21) by @devtank42 in #40
• feat: OIDC/OAuth2 browser login flow (#21) by @devtank42 in #42
• feat: branding asset upload, SVG sanitization, public serving by @devtank42 in #41
• fix: schedule cleanup of expired refresh and revoked tokens by @devtank42 in #51
• test: cover TokenRevocationService, JwtTokenService and refresh rotation (#44) by @devtank42 in #54
• fix: harden branding upload — SVG depth limit + I/O outside transaction by @devtank42 in #57
• perf: index application_setting.updated_by FK (issue #46) by @devtank42 in #58
• feat: distributed scheduler locks via ShedLock (Postgres-backed) by @devtank42 in #60
• fix: rate-limit hardening — trusted-proxy warning + bounded bucket cache by @devtank42 in #59
• fix: uniform ErrorResponse envelope for 401/403/429 + global @ControllerAdvice by @devtank42 in #55
• feat: optimistic locking for ApplicationSetting by @devtank42 in #56
• feat: atomic single-use guard for verification/reset tokens (part 2 of #61) by @devtank42 in #63
• feat: concurrency control for User writes (part 1 of #61) by @devtank42 in #62
• ci: override Renovate schedule so PRs are actually opened (#64) by @devtank42 in #65
• chore: phase-1 review code-quality follow-ups (issue #50) by @devtank42 in #66
• ci: pass App secrets to Renovate via secrets: inherit (#67) by @devtank42 in #68
• fix: drop invalid comment:schedule key from renovate.json by @devtank42 in #70
• ci: raise Renovate prHourlyLimit to 10 by @devtank42 in #74
• chore(deps): pin dependencies by @qnop-renovate[bot] in #72
• chore(deps): pin dependencies by @qnop-renovate[bot] in #73
• fix: ignore generated files in Prettier (unblock Renovate npm PRs) (#80) by @devtank42 in #81
• chore(deps): pin dependencies by @qnop-renovate[bot] in #75
• fix(deps): pin dependencies by @qnop-renovate[bot] in #79
• chore(deps): pin dependencies by @qnop-renovate[bot] in #76
• fix(deps): pin dependencies by @qnop-renovate[bot] in #77
• fix(deps): update swaggerannotations to v2.2.51 by @qnop-renovate[bot] in #83
• fix(deps): pin dependencies by @qnop-renovate[bot] in #78
• chore(deps): update gradle wrapper to v9.6.0 by @qnop-renovate[bot] in #85
• chore(deps): update npm dependencies to v11.8.0 by @qnop-renovate[bot] in #86
• fix(deps): update test dependencies by @qnop-renovate[bot] in #84
• chore(deps): update frontend lint/types tooling by @qnop-renovate[bot] in #82
• chore(deps): update openapigenerator by @qnop-renovate[bot] in #87
• fix(deps): update bucket4j by @qnop-renovate[bot] in #88
• fix(deps): update build tooling to v8.7.0 by @qnop-renovate[bot] in #89
• fix(deps): update jackson monorepo by @qnop-renovate[bot] in #90
• fix(deps): update shedlock monorepo to v7.7.0 by @qnop-renovate[bot] in #91
• chore(deps): update docker base images (major) by @qnop-renovate[bot] in #92
• chore(deps): update github actions major updates (major) by @qnop-renovate[bot] in #93
• fix(deps): update test dependencies (major) by @qnop-renovate[bot] in #94
• chore: guard qnop-ui against non-pnpm installs (#95) by @devtank42 in #96
• feat: global role model (ADMIN/MEMBER/AUDITOR) + fix admin authority in JWT by @bigpuritz in #107
• feat: GET /users/me profile endpoint + wire /config self-registration by @bigpuritz in #108
• chore: auto-load .env in bootRun for local dev by @bigpuritz in #111
• feat(ui): frontend foundation — routing, react-query, generated API client, auth by @bigpuritz in #109
• feat(ui): devtank42 design system as MUI theme (Outfit, navy/blue, light+dark) by @bigpuritz in #112
• feat(ui): app shell — sidebar, top bar, breadcrumbs, role-aware nav by @bigpuritz in #113
• feat(ui): auth screens — login, register, password reset, email verify, OIDC by @bigpuritz in #114
• feat: admin user management — /admin/users CRUD + UI (#104) by @bigpuritz in #115
• feat(ui): auth screen redesign + switch all UI texts to English (#118) by @bigpuritz in #119
• feat: teams subsystem — entity, /admin/teams CRUD, memberships + UI (#105) by @bigpuritz in #120
• test: cross-cutting authorization coverage for the Administration surface (#122) by @bigpuritz in #123
• feat: user-management feature parity — delete, filters/sort, provider name, reset (#124) by @bigpuritz in #125
• feat(ui): application settings screen + admin menu items (#106) by @devtank42 in #121
• fix: forced first-login password change — min-length + clear forced-change flag (#128, #130) by @bigpuritz in #129
• fix(deps): update npm dependencies by @qnop-renovate[bot] in #127
• chore(deps): update postgres:18 docker digest to 4efc78b by @qnop-renovate[bot] in #134
• fix(deps): update dependency io.swagger.core.v3:swagger-annotations to v2.2.52 by @qnop-renovate[bot] in #132
• feat: OIDC end-to-end — provider mgmt, login flow, account lifecycle, Keycloak test setup (#106) by @devtank42 in #126
• fix(deps): update dependency @mui/material to v9.1.2 by @qnop-renovate[bot] in #137
• chore(deps): update postgres:18 docker digest to 1a5b3e7 by @qnop-renovate[bot] in #136
• feat: reset / regenerate a user's password from the UI (#116) by @bigpuritz in #138
• feat(ui): mail template editor screen (#106) by @devtank42 in #147
• feat: profile-picture upload (admin + self-service) (#117) by @bigpuritz in #148
• fix(deps): update npm dependencies by @qnop-renovate[bot] in #131
• chore(deps): update vite by @qnop-renovate[bot] in #135
• chore(deps): update actions/setup-java digest to 1bcf9fb by @qnop-renovate[bot] in #151
• chore(deps): pin quay.io/keycloak/keycloak docker tag to 9b03307 ...