security: add Trivy container scan to Docker publish workflow (#399)

* feat(admin): add backup manager UI with 1-click restore

* feat(admin): collapse older backup entries by default

* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle

* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards

* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)

* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards

* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards

* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar

* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx

* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile

* style(admin): replace all emojis with clean Leica-style vector SVG icons

* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons

* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings

* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode

* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx

* fix(types): add protection and watermark optional properties to AppConfig interface

* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)

* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator

* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules

* fix(types): import type LightboxWatermark in PhotoGrid.tsx

* fix(types): destructure watermark prop in PhotoGrid function signature

* feat(seo): add configurable subpage title template and metadata descriptions

* feat(seo): add generateMetadata to about page for title template support

* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal

* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts

* feat(subpages): add page enabled toggle to deactivate subpages without deleting them

* feat(admin): add visual essay block builder for photo essay storytelling pages

* security: add Trivy container scan to Docker publish workflow

Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

lib/__tests__/derive-gallery.test.ts

@@ -103,4 +103,16 @@ describe('deriveGallery accepts valid structures', () => {
     expect(result.albumDescriptions[A]).toBe('A note');
     expect(result.albumHeroImages[A]).toBe(B);
   });
+
+  it('parses enabled property on subpages correctly', () => {
+    const result = deriveGallery({
+      subpages: [
+        { name: 'Active Page', albums: [A], enabled: true },
+        { name: 'Disabled Page', albums: [B], enabled: false },
+      ],
+    } as unknown as GalleryYaml);
+
+    expect(result.subpages[0].enabled).toBe(true);
+    expect(result.subpages[1].enabled).toBe(false);
+  });
 });

lib/__tests__/essay.test.ts

@@ -0,0 +1,120 @@
+import { describe, it, expect } from 'vitest';
+import { parseEssayMarkdown, parseFrontmatter, sanitizeHtml, renderInlineMarkdown, serializeEssayMarkdown } from '../essay';
+
+describe('Essay Parser', () => {
+  it('sanitizes script tags to prevent XSS', () => {
+    const input = 'Hello <script>alert("XSS")</script> World';
+    expect(sanitizeHtml(input)).toBe('Hello  World');
+  });
+
+  it('renders inline markdown formatting correctly', () => {
+    const text = 'This is **bold** and *italic* with a [link](https://example.com)';
+    const rendered = renderInlineMarkdown(text);
+    expect(rendered).toContain('<strong>bold</strong>');
+    expect(rendered).toContain('<em>italic</em>');
+    expect(rendered).toContain('<a href="https://example.com" target="_blank" rel="noopener noreferrer">link</a>');
+  });
+
+  it('parses frontmatter correctly', () => {
+    const markdown = `---
+title: "The Icelandic Highlands"
+subtitle: "A visual journey across black sand and glaciers"
+author: "Ralf"
+date: "2026-08-05"
+coverAssetId: "asset-123"
+---
+
+# Section 1
+First paragraph text.`;
+
+    const { frontmatter, body } = parseFrontmatter(markdown);
+    expect(frontmatter.title).toBe('The Icelandic Highlands');
+    expect(frontmatter.subtitle).toBe('A visual journey across black sand and glaciers');
+    expect(frontmatter.author).toBe('Ralf');
+    expect(frontmatter.date).toBe('2026-08-05');
+    expect(frontmatter.coverAssetId).toBe('asset-123');
+    expect(body.trim()).toMatch(/^# Section 1/);
+  });
+
+  it('parses structured essay blocks (headings, quotes, photos, photo-pairs)', () => {
+    const markdown = `---
+title: "Test Story"
+---
+
+# Highland Sunrise
+
+> Silence was absolute across the tundra. -- Ralf
+
+![asset-1:fullbleed](Sunrise over the ridge)
+
+![asset-2, asset-3](Side-by-side details)
+
+A closing paragraph with **bold** details.`;
+
+    const parsed = parseEssayMarkdown(markdown);
+    expect(parsed.frontmatter.title).toBe('Test Story');
+    expect(parsed.blocks.length).toBe(5);
+
+    // Block 0: Heading
+    expect(parsed.blocks[0]).toEqual({
+      type: 'heading',
+      level: 1,
+      text: 'Highland Sunrise',
+    });
+
+    // Block 1: Quote
+    expect(parsed.blocks[1]).toEqual({
+      type: 'quote',
+      text: 'Silence was absolute across the tundra.',
+      author: 'Ralf',
+    });
+
+    // Block 2: Fullbleed Photo
+    expect(parsed.blocks[2]).toEqual({
+      type: 'photo',
+      assetId: 'asset-1',
+      caption: 'Sunrise over the ridge',
+      layout: 'fullbleed',
+    });
+
+    // Block 3: Photo Pair
+    expect(parsed.blocks[3]).toEqual({
+      type: 'photo-pair',
+      assetIds: ['asset-2', 'asset-3'],
+      caption: 'Side-by-side details',
+    });
+
+    // Block 4: Paragraph
+    expect(parsed.blocks[4].type).toBe('paragraph');
+    if (parsed.blocks[4].type === 'paragraph') {
+      expect(parsed.blocks[4].html).toContain('<strong>bold</strong>');
+    }
+
+    // Referenced Assets
+    expect(parsed.referencedAssetIds).toContain('asset-1');
+    expect(parsed.referencedAssetIds).toContain('asset-2');
+    expect(parsed.referencedAssetIds).toContain('asset-3');
+  });
+
+  it('serializes structured essay blocks back to markdown', () => {
+    const parsed = {
+      frontmatter: { title: 'Story Title', author: 'Author' },
+      blocks: [
+        { type: 'heading' as const, level: 1, text: 'Chapter One' },
+        { type: 'paragraph' as const, html: 'This is <strong>bold</strong> text.' },
+        { type: 'quote' as const, text: 'A great quote', author: 'Person' },
+        { type: 'photo' as const, assetId: 'photo-1', caption: 'Caption', layout: 'fullbleed' as const },
+        { type: 'photo-pair' as const, assetIds: ['p1', 'p2'] as [string, string], caption: 'Pair caption' },
+      ],
+      referencedAssetIds: ['photo-1', 'p1', 'p2'],
+    };
+
+    const markdown = serializeEssayMarkdown(parsed);
+    expect(markdown).toContain('title: "Story Title"');
+    expect(markdown).toContain('# Chapter One');
+    expect(markdown).toContain('This is **bold** text.');
+    expect(markdown).toContain('> A great quote -- Person');
+    expect(markdown).toContain('![photo-1:fullbleed](Caption)');
+    expect(markdown).toContain('![p1, p2](Pair caption)');
+  });
+});

lib/__tests__/proofing.test.ts

@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+import { encodeProofBitmask, decodeProofBitmask } from '../proofing';
+
+describe('lib/proofing', () => {
+  it('returns empty string for empty or invalid indices', () => {
+    expect(encodeProofBitmask([])).toBe('');
+    expect(encodeProofBitmask([-1])).toBe('');
+  });
+
+  it('encodes and decodes simple asset indices', () => {
+    const indices = [0, 3, 5, 12];
+    const encoded = encodeProofBitmask(indices);
+    expect(typeof encoded).toBe('string');
+    expect(encoded.length).toBeGreaterThan(0);
+
+    const decoded = decodeProofBitmask(encoded);
+    expect(decoded).toEqual([0, 3, 5, 12]);
+  });
+
+  it('handles duplicate and unsorted indices gracefully', () => {
+    const indices = [15, 2, 2, 7, 0];
+    const encoded = encodeProofBitmask(indices);
+    const decoded = decodeProofBitmask(encoded);
+    expect(decoded).toEqual([0, 2, 7, 15]);
+  });
+
+  it('clamps indices to totalCount if provided', () => {
+    const indices = [1, 5, 10];
+    const encoded = encodeProofBitmask(indices);
+    const decoded = decodeProofBitmask(encoded, 6);
+    expect(decoded).toEqual([1, 5]);
+  });
+
+  it('returns empty array for invalid bitmask strings', () => {
+    expect(decodeProofBitmask('invalid-junk-!!!')).toEqual([]);
+    expect(decodeProofBitmask('')).toEqual([]);
+  });
+});