release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

lib/admin/pageSlugs.ts

@@ -0,0 +1,27 @@
+/**
+ * The slugs a content page must not take (#722), gathered from the live
+ * configuration: subpages, standalone albums and journal entries. The fixed
+ * routes are checked by pageSlugCollision() itself.
+ *
+ * Server only. Album slugs need Immich; when it cannot answer, the album list
+ * is empty rather than the whole check failing — a save during an Immich
+ * outage should not be refused for a reason nobody can see.
+ */
+
+import { getConfig } from '../config';
+import { immich } from '../immich';
+import { listJournalEntries } from './journal-service';
+import type { SlugTakenBy } from '../pages';
+
+export async function takenPageSlugs(): Promise<SlugTakenBy> {
+  const config = getConfig();
+  const [albums, journal] = await Promise.all([
+    immich.getStandaloneAlbums().catch(() => []),
+    listJournalEntries().catch(() => []),
+  ]);
+  return {
+    subpages: config.subpages.map((sp) => sp.slug),
+    albums: albums.map((a) => a.slug),
+    journal: journal.map((e) => e.slug),
+  };
+}