release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/api/admin/doctor/route.ts

@@ -6,7 +6,11 @@ import { getConfig, slugify } from '@/lib/config';
 import { env } from '@/lib/env';
 import { listJournalEntries } from '@/lib/admin/journal-service';
 import { readSettingsYaml } from '@/lib/admin/yaml-service';
+import { validateSettingValues } from '@/lib/config/settingValues';
 import { readPrivacy } from '@/lib/privacy';
+import { listPageSlugsSync } from '@/lib/admin/pages-service';
+import { takenPageSlugs } from '@/lib/admin/pageSlugs';
+import { describeCollision, menuPageSlugs, pageSlugCollision } from '@/lib/pages';
 import {
   checkAlbumIds,
   checkAlbumSlugCollisions,
@@ -15,8 +19,10 @@ import {
   checkCdn,
   checkImmichCalls,
   checkContact,
+  checkContentPages,
   checkLegal,
   checkPrivacy,
+  checkSettingValues,
   checkPasswords,
   checkProxyHops,
   checkWritable,
@@ -153,6 +159,9 @@ export const GET = withAdmin(async (request: NextRequest) => {
     const settings = await readSettingsYaml();
     rawLegal = settings?.legal ?? rawLegal;
     rawContact = settings?.contact ?? rawContact;
+    // Values the resolvers replaced on the way into `config` — only the raw
+    // file still shows them.
+    findings.push(checkSettingValues(validateSettingValues(settings)));
   } catch {
     // Fall back to the resolved blocks; only a dropped URL goes unseen.
   }
@@ -167,10 +176,30 @@ export const GET = withAdmin(async (request: NextRequest) => {
   });
   if (privacy) findings.push(privacy);
 
+  // ── Content pages: missing menu targets and slug collisions (#722) ────
+  try {
+    const pageSlugs = listPageSlugsSync();
+    const taken = pageSlugs.length ? await takenPageSlugs() : null;
+    const collisions = taken
+      ? pageSlugs.flatMap((slug) => {
+          const collision = pageSlugCollision(slug, taken);
+          return collision ? [{ slug, reason: describeCollision(slug, collision) }] : [];
+        })
+      : [];
+    const pages = checkContentPages({
+      menuRefs: menuPageSlugs(config.nav),
+      pages: pageSlugs,
+      collisions,
+    });
+    if (pages) findings.push(pages);
+  } catch {
+    // Pages are optional; a failure to list them is not a finding of its own.
+  }
+
   // ── Writability of the content volume ────────────────────────────────
   const contentDir = path.join(process.cwd(), 'content');
   const unwritable: string[] = [];
-  for (const dir of ['', '.backups', 'journal']) {
+  for (const dir of ['', '.backups', 'journal', 'pages']) {
     const target = path.join(contentDir, dir);
     try {
       await fs.access(target, (await import('node:fs')).constants.W_OK);