release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/api/admin/proofing/[id]/route.ts

@@ -0,0 +1,59 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { withAdmin } from '@/lib/admin/withAdmin';
+import { picksFor, toAdminSession } from '@/lib/admin/proofing-view';
+import { immich } from '@/lib/immich';
+import {
+  deleteSession,
+  getSessionById,
+  ProofError,
+  sessionPatchSchema,
+  updateSession,
+} from '@/lib/proofSessions';
+
+type Context = { params: Promise<{ id: string }> };
+
+/** GET: one link with its selected photos. */
+export const GET = withAdmin(async (_request: NextRequest, { params }: Context) => {
+  const { id } = await params;
+  const session = await getSessionById(id);
+  if (!session) return NextResponse.json({ error: 'Not found' }, { status: 404 });
+  const album = await immich.getProofingAlbum(session.albumId).catch(() => null);
+  return NextResponse.json({
+    session: toAdminSession(session, album),
+    picks: picksFor(session, album),
+  });
+});
+
+/** PATCH: rename, change expiry or downloads, reopen, reset the download count. */
+export const PATCH = withAdmin(async (request: NextRequest, { params }: Context) => {
+  const { id } = await params;
+  const parsed = sessionPatchSchema.safeParse(await request.json().catch(() => null));
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: parsed.error.issues[0]?.message ?? 'Invalid input' },
+      { status: 400 },
+    );
+  }
+  try {
+    const session = await updateSession(id, parsed.data);
+    const album = await immich.getProofingAlbum(session.albumId).catch(() => null);
+    return NextResponse.json({ session: toAdminSession(session, album) });
+  } catch (err) {
+    if (err instanceof ProofError)
+      return NextResponse.json({ error: err.message }, { status: 404 });
+    throw err;
+  }
+});
+
+/** DELETE: revoke the link. The client URL stops working immediately. */
+export const DELETE = withAdmin(async (_request: NextRequest, { params }: Context) => {
+  const { id } = await params;
+  try {
+    await deleteSession(id);
+    return NextResponse.json({ ok: true });
+  } catch (err) {
+    if (err instanceof ProofError)
+      return NextResponse.json({ error: err.message }, { status: 404 });
+    throw err;
+  }
+});