Keep stray .env.bak*/.env.local files (e.g. created while wiring OIDC) out of
version control so credentials are never committed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML
entities the browser emits (e.g. for the space after a mention chip,
or & for a typed "&") no longer render as literal " "/"&".
Re-escaping keeps output XSS-safe. Adds regression tests.
- Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo
data dir (700-perm files); Makefile lint now gofmt's tracked files only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replace the named volumes mongo-data and work-data with bind mounts to
./volumes/mongo and ./volumes/work so all runtime state lives under the repo
tree. Existing data was migrated; the old named volumes were removed. The
${HOME}/.claude host-credential mounts are intentionally left as-is (must not
live in the repo). Added /volumes/ to .gitignore.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
etalon