0.12.0

Added

• UI: Integration → Import tracks: multi-select .gpx / .fit via the system file picker (web and Android), progress bar, snackbar summary, and external_id dedup (device-import + file fingerprint)
• Server: POST /workouts/parse-track returns optional sport_type parsed from FIT/GPX; add-workout and batch import apply it when present
• Server: ActivityPub HTTP Signatures (cavage-12): signed outbound delivery and GETs (instance actor at /actor), required signatures on inbound inboxes, optional federation.authorized_fetch (default on), shared-inbox routing, and sharedInbox fan-out dedupe

Changed

• Android: Removed Health Sync + Google Drive OAuth import (drive.readonly); use system file picker instead (Drive may still appear in the OS picker sidebar without app OAuth)
• Docs: Replaced Health Sync + Google Drive guide with Import tracks; privacy policy no longer describes Google Sign-In / Drive scopes
• UI: My workouts list layout on mobile: rows are flush with full-width thin dividers instead of 8 px gaps; card layout and web unchanged
• Docs: Federation configuration documents HTTP Signatures, authorized fetch, and the instance actor
• Docs: documentation site custom domain https://grom.solargate.team/ (was https://solargate.github.io/grom/)
• UI: About screen privacy policy link points to https://grom.solargate.team/privacy/

Fixed

• Server: Federated workout Like / Undo (and comment Note Create/Delete) delivered to the shared inbox are routed to the workout owner; outbound likes address the owner in to
• Server: Race between async profile sport refresh and remembering a newly used sport type could drop entries from used_sport_types
• Server: Federated Accept delivered to the shared inbox no longer leaves the follow stuck in pending (route by follower / follow activity id)