[hkrlogic]

Fixes the findings from the deep test of a fresh deploy, in one PR.

Breaking

• Compose now uses a new volume, postgres18_data, mounted at /var/lib/postgresql. Postgres 18 would not start on the old mount. Existing Compose installs must dump and restore or pin Postgres 16; the steps are in docs/deploy.md and CHANGELOG.
• update_item keeps any field you leave out. Pass replace: true to get the old whole-item replace.

Must-fix

• Postgres 18 volume mount, with an upgrade note and migration path
• Items tab shows live items that have a pending edit; the save message no longer contradicts itself
• After a web sign-out, MCP returns 401 with WWW-Authenticate and "Your sign-in ended; reconnect". A disabled account still gets its own message.
• Usernames instead of account ids on Apps, proposals and list_audit
• Read-only /audit page with paging (Site admin: all events; Publisher: their libraries)
• The Reader key works alone on /libraries/<id>/mcp, with no "rotate Connect" advice; Readers don't see rotate advice

Nice-to-have

• Plain-language web validation errors (MCP wording unchanged)
• "Kiosk" removed from all text
• update_item partial updates plus a replace flag
• entity_key upsert on create_item
• No empty "Main" library on a fresh install, and no duplicate Unclaimed listing (existing installs keep Main)
• Summary no longer repeated in the body; empty optional fields left out
• Flash messages after delete, revoke, and grant or remove access
• A deleted library returns 404
• A revoked app is listed as "Revoked" (migration 023)
• Token scope reflects the library role
• Unknown fields are refused with a clear error
• tools/list_changed: not feasible because each MCP request builds a fresh stateless server. The field-approval wording now says the next request picks up the change.
• Favicon; "1 item" singular; error pages show who is signed in
• README version line and the docs tool table match the code
• An account with no access is refused before the consent page, in plain words

Testing

• New tests in test/deep-test-findings.test.ts and test/deep-test-http.test.ts. npm test passes 405/405; lint, typecheck and npm audit are clean.
• Redeployed with the plain docker-compose.yml (Postgres 18, no override) and reran the deep-test checks.