v0.4.3 — admin export, dynamic attributes, corp readiness

[0.4.3] - 2026-06-19

Added

• Attendee list export to CSV, XLSX, and PDF with check-off column and formula-injection sanitization (#88)
• Dynamic custom attributes in admin drawer: edit fields driven by EventItem.config.contents instead of hardcoded shirt_size (ADR 0030, #91)
• Export columns follow EventItem.config.contents definitions; check-in parity preserved
• SECURITY-CONTROLS.md: configurable security capabilities table with TOTP and OIDC implementation detail
• CORPORATE-DEPLOYMENT.md: self-hosted model, customer-hosted stack, no SaaS
• ARCHITECTURE-FOR-AUDITORS.md: scope, generic exposure overview, roadmap flows
• GDPR-ONE-PAGER.md, SUBPROCESSORS.md: purposes, retention, subprocessor template, DSAR options
• DSAR-PROCEDURE.md: organizer-mediated access and erasure template (Option B)
• INCIDENT-RESPONSE.md: rotation, rollback, severity template; GDPR Art. 33/34 72-hour breach notification
• Zod validation on custom_data_fields keys; stable export column order (orderBy: key)
• Duplicate Excel headers disambiguated as Label (source_field); PDF column widths scale down when many attributes exceed printable width
• Export integration tests use isolated events

Changed

• DATA-PROTECTION.md updated with legal basis note (LIA for legitimate interest)

Fixed

• Drawer degrades gracefully when event-items API fails

Security

• Removed || true from Semgrep CI step — SAST findings now block pull requests (baseline verified at 0 findings before merge)

---

Deploy

• Container image: ghcr.io/solarssk/admitto:0.4.3 (rolling :0.4)
• Migrations apply automatically on container start (with pre-migration backup when pending). No manual migrate deploy.

Full changelog