release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

lib/focusTrap.ts

@@ -0,0 +1,55 @@
+/**
+ * Focus helpers for modal UI (lightbox) and the mobile nav panel (#696).
+ * Client-only: every function works on live DOM nodes.
+ */
+
+const FOCUSABLE = [
+  'a[href]',
+  'button:not([disabled])',
+  'input:not([disabled]):not([type="hidden"])',
+  'select:not([disabled])',
+  'textarea:not([disabled])',
+  '[tabindex]:not([tabindex="-1"])',
+].join(',');
+
+/** Keyboard-reachable elements inside `container`, in DOM order. */
+export function focusableIn(container: HTMLElement): HTMLElement[] {
+  return Array.from(container.querySelectorAll<HTMLElement>(FOCUSABLE)).filter(
+    (el) =>
+      !el.closest('[hidden], [inert], [aria-hidden="true"]') &&
+      el.tabIndex >= 0 &&
+      // A `display: none` control (the shortcut panel on touch devices) cannot
+      // take focus; wrapping onto it would strand the visitor.
+      (typeof el.checkVisibility !== 'function' || el.checkVisibility()),
+  );
+}
+
+/**
+ * Keeps Tab and Shift+Tab inside `container`: from the last element Tab wraps
+ * to the first, and the other way round. Focus that has escaped (or never
+ * entered) is pulled back in. Returns true when it moved focus itself.
+ */
+export function trapTabKey(container: HTMLElement, e: KeyboardEvent): boolean {
+  if (e.key !== 'Tab') return false;
+  const items = focusableIn(container);
+  if (items.length === 0) {
+    e.preventDefault();
+    return true;
+  }
+  const first = items[0];
+  const last = items[items.length - 1];
+  const active = document.activeElement as HTMLElement | null;
+  const inside = active !== null && container.contains(active);
+
+  if (e.shiftKey && (!inside || active === first)) {
+    e.preventDefault();
+    last.focus();
+    return true;
+  }
+  if (!e.shiftKey && (!inside || active === last)) {
+    e.preventDefault();
+    first.focus();
+    return true;
+  }
+  return false;
+}