Merge branch 'worktree-check-security-audit'

Security and frontend-correctness hardening: analytics IDOR fix, scraper
log scrubbing, lowercase email normalisation (migration 009), stale-response
guards in the plan hooks, busy flags cleared unconditionally across all
useLatestRequest consumers, Calendar no longer blanks on mutation, plus
dependabot/CI config and removal of the stray frontend/out.js.

Conflicts came from main's later "day assertions" restructure, which made
usePlannedDays read-only and replaced the calendar's per-day add/update with
useDayAssertions.assertDay. Both intents kept:

- usePlannedDays: branch's fetch machinery (isRefreshing, in-flight dedup,
  unguarded busy clear); mutators dropped as on main.
- usePlanSync: branch's useLatestRequest guard also applied to main's new
  syncWithWish.
- useDayAssertions / useLatestBalance (new on main): busy flag now cleared
  unconditionally, as the branch did for every other consumer.
- useDayAssertions.assertDay gains the branch's `skipRefresh` option and a
  `refresh`, so Calendar's multi-day save keeps the batch shape (N writes,
  one trailing bumpPlanVersion + one assertions refresh) on main's
  assertDay path. Branch's M7 tests ported from the removed add/update API
  to assertDay.
- PlanSyncProvider: branch's isAuthenticated gate kept; eviction-preview
  state stays removed as on main.
- usePlannedDayExclusions.ts stays deleted (superseded by useDayAssertions).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T4wjgbVL4HAC5Rdaw75VbV

CLAUDE.md

@@ -175,6 +175,7 @@ Binding for all work here, not just verification.
 * **Post-edit verification:** check immediately for duplicated lines and intact imports.
 * **Stability check:** after any change, run that side's lint + typecheck + tests. For cross-cutting changes (e.g. API contract edits in `app/models` and `src/types`), run **both** suites — they must agree on the wire format.
 * **Keep the graph current:** `graphify update .` after code changes.
+* **Always commit:** commit finished work without being asked — this overrides any default to wait for permission. Commit once the gates are green, never mid-change or over a failing suite. **Push and PRs still require an explicit ask.** Never commit on the default branch; branch first.
 
 ---
 
@@ -202,4 +203,15 @@ Unsure about a rule? Ask before encoding a number — Swedish rules change, and
 
 ## OUTPUTS
 
-Be concise: no preamble, caveats, or restating the request. Sentence fragments and short bullets where clarity holds. Explain reasoning only when it aids debugging or isn't obvious from the code/diff.
+**Default reply: 1-5 lines.** Bullets or a small table. No preamble, no recap, no restating the request.
+
+Hard rules:
+* Lead with the answer. A yes/no question gets yes or no on line one.
+* One line per finding. Name it, say it's fixed, move on.
+* Never re-narrate a subagent report or a diff — extract the decision, drop the rest.
+* Never explain reasoning that wasn't asked for, and never justify a choice in more than one clause.
+* No "want me to X?" when X is obvious.
+
+Length is **not** licensed by a finding being important, security-related, or surprising. An important finding gets a short, blunt line — that is what makes it get read. The only things that may run long: raw failure output, and an open product trade-off that needs a decision.
+
+Explain reasoning only when it aids debugging or isn't obvious from the code/diff.