security: add Trivy container scan to Docker publish workflow (#399)

* feat(admin): add backup manager UI with 1-click restore

* feat(admin): collapse older backup entries by default

* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle

* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards

* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)

* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards

* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards

* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar

* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx

* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile

* style(admin): replace all emojis with clean Leica-style vector SVG icons

* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons

* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings

* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode

* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx

* fix(types): add protection and watermark optional properties to AppConfig interface

* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)

* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator

* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules

* fix(types): import type LightboxWatermark in PhotoGrid.tsx

* fix(types): destructure watermark prop in PhotoGrid function signature

* feat(seo): add configurable subpage title template and metadata descriptions

* feat(seo): add generateMetadata to about page for title template support

* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal

* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts

* feat(subpages): add page enabled toggle to deactivate subpages without deleting them

* feat(admin): add visual essay block builder for photo essay storytelling pages

* security: add Trivy container scan to Docker publish workflow

Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

app/api/analytics/track/route.ts

@@ -0,0 +1,75 @@
+import { NextResponse } from 'next/server';
+import fs from 'fs/promises';
+import path from 'path';
+import { getConfigOrNull } from '@/lib/config';
+
+const CONTENT_DIR = path.join(process.cwd(), 'content');
+const ANALYTICS_FILE = path.join(CONTENT_DIR, 'analytics.json');
+
+interface AnalyticsData {
+  summary: {
+    totalViews: number;
+    lastUpdated: string;
+  };
+  days: Record<
+    string,
+    {
+      pageviews: number;
+      pages: Record<string, number>;
+      devices: Record<string, number>;
+    }
+  >;
+}
+
+async function getAnalytics(): Promise<AnalyticsData> {
+  try {
+    const raw = await fs.readFile(ANALYTICS_FILE, 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return { summary: { totalViews: 0, lastUpdated: new Date().toISOString() }, days: {} };
+  }
+}
+
+async function saveAnalytics(data: AnalyticsData) {
+  try {
+    await fs.mkdir(CONTENT_DIR, { recursive: true });
+    await fs.writeFile(ANALYTICS_FILE, JSON.stringify(data, null, 2), 'utf8');
+  } catch (err) {
+    console.error('[Analytics] Failed to save analytics data:', err);
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const config = getConfigOrNull();
+    if (config?.analytics === false) {
+      return NextResponse.json({ ok: true, trackingDisabled: true });
+    }
+
+    const body = await req.json();
+    const pagePath = (body.path || '/').split('?')[0];
+    const userAgent = req.headers.get('user-agent') || '';
+    const isMobile = /mobile|iphone|ipad|android/i.test(userAgent);
+    const deviceType = isMobile ? 'mobile' : 'desktop';
+
+    const dateKey = new Date().toISOString().split('T')[0];
+    const data = await getAnalytics();
+
+    data.summary.totalViews = (data.summary.totalViews || 0) + 1;
+    data.summary.lastUpdated = new Date().toISOString();
+
+    if (!data.days[dateKey]) {
+      data.days[dateKey] = { pageviews: 0, pages: {}, devices: {} };
+    }
+
+    const dayObj = data.days[dateKey];
+    dayObj.pageviews = (dayObj.pageviews || 0) + 1;
+    dayObj.pages[pagePath] = (dayObj.pages[pagePath] || 0) + 1;
+    dayObj.devices[deviceType] = (dayObj.devices[deviceType] || 0) + 1;
+
+    await saveAnalytics(data);
+    return NextResponse.json({ ok: true });
+  } catch (err) {
+    return NextResponse.json({ error: 'Failed to record tracking' }, { status: 500 });
+  }
+}