fix(deploy): trust x-forwarded-for for per-IP rate limiting

fix(app): 503 on storage failures, validated currency, lock release on shutdown, per-IP login limit, unit-only npm test

fix(auth): gate admin routes on the decoded path and in the actions themselves

fix(ui): shared safe-next validation, no lockout on success, logout origin check, tab/feed polish

feat(ui): add expense form with live split editor and photo upload

fix(app): stop guard on boot failure, validate compaction interval, harden hooks

fix(photos,forms): own-property content types, dimension bounds, VP8L signature, trimmed inputs

fix(auth): bound scrypt params, cap concurrency, evict rate-limit keys, re-bootstrap admin

feat(app): wire config, singleton app bootstrap, and auth hooks

fix(ledger): writer guard re-checks ownership and self-demotes on stale heartbeat

feat(forms): parse and validate expense/settlement forms; photo sniffing

feat(users): add UsersRepo with admin bootstrap and password management

feat(auth): add scrypt hashing, signed session tokens and rate limiter

test(ledger): prove compaction crash safety with fault injection and against the real bucket

feat(ledger): add heartbeat-based writer guard

fix(ledger): heal truncated ledger, validate events on write, reconcile pending

feat(ledger): add Ledger service with event write path and compaction

feat(ledger): add event schema, jsonl encoding and fold

fix(storage): skip integration suite safely, tighten list contract, drop expand

feat(storage): add HfBucketStore with opt-in real-bucket integration test

fix(storage): atomic temp files, directory-safe get/delete, list contract docs

feat(storage): add BucketStore interface, LocalFsStore and PrefixedStore

chore: scaffold SvelteKit project with Tailwind, Vitest, adapter-node