release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/api/proof/[token]/selection/route.ts

@@ -0,0 +1,51 @@
+/**
+ * PUT /api/proof/:token/selection — replace a client's saved selection.
+ *
+ * Body: `{ "assets": [<asset token>, …] }`, the album's opaque asset tokens in
+ * any order. Answers 409 once the selection has been submitted, which the page
+ * turns into its locked state.
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { decodeSelection, proofError, resolveProofAccess } from '@/lib/proofAccess';
+import { MAX_SELECTION, ProofError, saveSelection } from '@/lib/proofSessions';
+import { readJsonCapped } from '@/lib/requestBody';
+
+export const dynamic = 'force-dynamic';
+
+/** Autosave fires once per burst of hearts; this is generous for one visitor. */
+const SELECTION_RPM = 60;
+
+/** MAX_SELECTION tokens of ~70 characters each, with room to spare. */
+const MAX_BODY_BYTES = 256 * 1024;
+
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: Promise<{ token: string }> },
+) {
+  const { token } = await params;
+  const access = await resolveProofAccess(request, token, 'proof-save', SELECTION_RPM);
+  if ('error' in access) return access.error;
+
+  const body = (await readJsonCapped(request, MAX_BODY_BYTES)) as { assets?: unknown } | null;
+  const assets = body?.assets;
+  if (!Array.isArray(assets) || assets.length > MAX_SELECTION) {
+    return proofError(400, 'Invalid selection');
+  }
+  const ids = decodeSelection(assets, access.assets);
+  if (!ids) return proofError(400, 'Invalid selection');
+
+  try {
+    const session = await saveSelection(token, ids);
+    return NextResponse.json(
+      { ok: true, selected: session.selection.length },
+      { headers: { 'Cache-Control': 'no-store' } },
+    );
+  } catch (err) {
+    if (err instanceof ProofError && err.code === 'submitted') {
+      return proofError(409, 'Selection already submitted');
+    }
+    if (err instanceof ProofError) return proofError(404, 'Not found');
+    throw err;
+  }
+}