release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

CONTRIBUTING.md

@@ -75,6 +75,12 @@ cheaper to test and stays tested when the markup around it changes. Reach for a
 component test when the behaviour _is_ the rendering: a state that hides a form,
 a control that must stay disabled, a keyboard shortcut.
 
+**Never write into the checkout's `content/`.** On a self-hosted install that
+directory is the live site. Services resolve it from `process.cwd()`, so a test
+that saves or deletes anything points `cwd` at a temp directory first and
+re-imports the service — `lib/__tests__/journal-backup.test.ts` shows how.
+`vitest.content-guard.ts` fails any test that writes there anyway.
+
 ## Code style
 
 - **TypeScript** — strict mode, no `any` without justification