SPEC v0.34: L-10 implemented (D-156), W0b recorded, web version code in the image build

- AC-3.2, E-16 (§14.3.4), §11.4: the "to implement" notes removed; D-156 says
  implemented in 07c36d2; security review L-10 note: fixed in 07c36d2. ctutils
  0.4.4 (RUSTSEC-2026-0385) in the v0.34 row. Server tests 300, contracts-check 136.
- §15.3: W0b as built (5305f37): shared pieces, no cross-feature imports or web_
  keys, per-locale amount fields, Recharts chunk, Vitest cache off, version code.
  Web gate 609 tests.
- server/Dockerfile: ARG KVITT_VERSION_CODE=1 in the Node stage, passed to
  npm run build; the Gitea workflow computes git rev-list --count HEAD and passes
  it as a build argument (§10.3).
- HANDOFF: main 5305f37 pushed 2026-10-24; next image build, deploy, laptop login,
  browser checks; Web follow-ups closed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

docs/validation/security-review.md

@@ -97,6 +97,8 @@ Location: `server/crates/kvitt-server/src/api/devices.rs:57-63` (404 for unknown
 Issue: trivial information leak between the two trusted users; listed for completeness.
 Fix (server): return 404 in both cases, or leave as is.
 
+> **Note 2026-10-24 (D-156, SPEC v0.34):** fixed in `07c36d2`. A member naming the other user's device gets 404 `not_found` with the same body as an unknown id; the admin still revokes any device except the current one; `contracts/openapi.yaml` no longer lists 403 for E-16.
+
 ### Info
 
 **I-1.** `X-Kvitt-Server-Version` on every response and `GET /health` (`server_version`, `schema_version`, `db_ok`) are visible to unauthenticated scanners (`src/router.rs:125-131`, `src/api/health.rs`). Spec-mandated; the version is not a secret. Accept.