[snapetech]

Description

Integrates the Phase 7 ReadMeABook and per-user book features, hardens configured outbound integrations and credential handling, updates dependencies with available security fixes, and fixes two newly reported production issues. The contributor policy now permits maintainer-approved AI-assisted work with disclosure, and the auto-close action for AI-generated PRs is removed.

Fixes #169 and #170.

How Has This Been Tested?

• Reproduced Creating local user with password setup link crashes SeerrNG when recipientName is undefined #169 before the fix: rendering resetpassword/html.pug with recipientName: undefined threw Cannot read properties of undefined (reading 'replace'). After the fix, the template renders, and the local-user route creates the account with a rendered password-setup greeting (1/1 route regression passed).
• Reproduced Lidarr library scan fails when album response exceeds 64 MiB #170 before the fix: the scanner called the full /album endpoint and received the reported maxContentLength size of 67108864 exceeded failure. After the fix, 23 focused email/API/scanner tests pass, including multi-artist library processing and no orphan cleanup after a partial scan.
• Server TypeScript typecheck, ESLint, Prettier, git diff --check, release-note validation, and release-note preview passed.
• Phase 7 cumulative candidate: Vitest 471 passed; native TypeScript 3,099 passed with four PostgreSQL-only skips; native JavaScript 493 passed. The tooling lane had 31/237 failures on macOS ARM64 due to Linux/GNU command assumptions.
• The CodeQL request-forgery and file-data alerts were reviewed as false positives for the documented admin-configured integration flows; the rationale is recorded in docs/maintainers/codeql-triage-2026-10-07.md. Latest CodeQL analysis is running.
• GitHub CI, Cypress, CodeQL, and docs checks on e2e85db5 are in progress. The local build was not run here; it is assigned to the separate build agent.
• No live ReadMeABook, Hardcover, or other provider round-trips were performed.

Screenshots / Logs (if applicable)

The project owner confirmed review and approval of the candidate. No screenshot artifact or live-service log is attached.

Release Notes

• I added a release-note fragment under release-notes/.
• This change is internal-only and does not need a user-facing release note.
• The fragments include audience, area, action, and breaking-change status.
• I previewed the release text with scripts/preview-release-notes.mjs.

Checklist:

• I have read and followed the contribution guidelines.
• Disclosed any use of AI (see our policy)
• I have updated the documentation accordingly.
• All new and existing tests passed.
• Successful build pnpm build
• Translation keys pnpm i18n:extract
• Database migration (if required)

AI Disclosure: Codex assisted with implementation and verification. The project owner confirmed review and approval.