- nginx: add X-Content-Type-Options, X-Frame-Options, X-XSS-Protection,
and Referrer-Policy headers on all responses; rate limit /api/auth/login
to 5 req/min per IP (burst 3) to prevent brute force
- frontend: add escHtml() utility to api.js; use it on all notes fields
across dashboard, log, history, flock, and budget pages to prevent XSS
- log.js: fix broken loadRecent() call referencing removed #recent-body
element; replaced with loadHistory() from history.js
- schemas.py: raise minimum password length from 6 to 10 characters
- admin.py: add audit logging for password reset, disable, delete, and
impersonate actions; fix impersonate to use named admin param for logging
- main.py: add startup env validation — exits with clear error if any
required env var is missing; configure structured logging to stdout
- docker-compose.yml: add log rotation (10 MB / 3 files) to all services
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- New other_purchases table (date, total, notes)
- /api/other CRUD endpoints
- Budget stats now include other costs in cost/egg and cost/dozen math
- Budget page: new Log Other Purchases form, stat cards for other costs,
combined Purchase History table showing feed and other entries together
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
