security: add Trivy container scan to Docker publish workflow (#399)

* feat(admin): add backup manager UI with 1-click restore

* feat(admin): collapse older backup entries by default

* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle

* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards

* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)

* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards

* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards

* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar

* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx

* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile

* style(admin): replace all emojis with clean Leica-style vector SVG icons

* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons

* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings

* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode

* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx

* fix(types): add protection and watermark optional properties to AppConfig interface

* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)

* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator

* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules

* fix(types): import type LightboxWatermark in PhotoGrid.tsx

* fix(types): destructure watermark prop in PhotoGrid function signature

* feat(seo): add configurable subpage title template and metadata descriptions

* feat(seo): add generateMetadata to about page for title template support

* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal

* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts

* feat(subpages): add page enabled toggle to deactivate subpages without deleting them

* feat(admin): add visual essay block builder for photo essay storytelling pages

* security: add Trivy container scan to Docker publish workflow

Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

lib/proofing.ts

@@ -0,0 +1,65 @@
+/**
+ * Bitmask encoder/decoder for compact proofing URL query parameters.
+ * Serializes selected asset indices in an album into a short base64url string.
+ */
+
+/**
+ * Encode an array of 0-based asset indices into a compact base64url bitmask.
+ */
+export function encodeProofBitmask(indices: number[]): string {
+  if (!indices || indices.length === 0) return '';
+  const sorted = Array.from(new Set(indices)).sort((a, b) => a - b);
+  const maxIndex = sorted[sorted.length - 1];
+  if (maxIndex < 0) return '';
+
+  const numBytes = Math.ceil((maxIndex + 1) / 8);
+  const bytes = new Uint8Array(numBytes);
+
+  for (const idx of sorted) {
+    if (idx < 0) continue;
+    const byteIdx = Math.floor(idx / 8);
+    const bitIdx = idx % 8;
+    bytes[byteIdx] |= 1 << bitIdx;
+  }
+
+  let binary = '';
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+/**
+ * Decode a base64url bitmask string back into an array of selected asset indices.
+ */
+export function decodeProofBitmask(code: string, totalCount?: number): number[] {
+  if (!code || typeof code !== 'string') return [];
+  try {
+    let base64 = code.trim().replace(/-/g, '+').replace(/_/g, '/');
+    while (base64.length % 4) {
+      base64 += '=';
+    }
+    const binary = atob(base64);
+    const result: number[] = [];
+
+    for (let byteIdx = 0; byteIdx < binary.length; byteIdx++) {
+      const byte = binary.charCodeAt(byteIdx);
+      for (let bitIdx = 0; bitIdx < 8; bitIdx++) {
+        if (byte & (1 << bitIdx)) {
+          const index = byteIdx * 8 + bitIdx;
+          if (totalCount === undefined || index < totalCount) {
+            result.push(index);
+          }
+        }
+      }
+    }
+
+    return result;
+  } catch {
+    return [];
+  }
+}