One account nobody else can throw out

New

• One account nobody else can throw out. Until now every administrator was equal, so appointing a second one also handed them the power to remove the first: switch the account off, demote it, or simply set a new password and become them. Exactly one account now carries an Owner badge in Settings → Users. It grants its holder nothing; it only says what others may not do with that account, and the buttons that would have done it are greyed out with a sentence saying why. Handing it on is the owner's alone, under Profile → Security, and there is no way back. If you ever lock yourself out, NEXVIEW_BETREIBER=<username> at startup puts the flag back.
• House rules: your own text, if you want one. What may be requested, how long titles stay, who to write to when something is broken. You can write it down under Settings → House rules instead of explaining it once in a message nobody finds again. A toolbar, images, and the finished page rendered live beside the editor. Everyone else reaches it through a § button in the bottom right corner, with a dot on it until they have read the current version. Entirely optional: leave it empty and there is no button either.

Fixed

Sign-in through a provider got a full pass. If you run authentik, Keycloak, Authelia, Zitadel or Pocket ID, this release is worth taking.

• Two kinds of provider could never sign in at all. ES512 and Ed25519 signatures were rejected (Pocket ID offers both), and a signed userinfo response, which Authelia and Zitadel can return, was silently discarded. Anyone in either group got "the provider's identity token could not be verified" on every attempt, with nothing in the log pointing at the reason. Both work now.
• A stranger could lock every user out. The sign-in throttle counted per provider rather than per person: ten failed callbacks from any browser, no account and no password needed, and nobody could use that provider for fifteen minutes, repeatable indefinitely. The same thing happened by accident after a mistyped client secret.
• The lock-out guard had three side doors. Deleting a provider is refused when accounts would lose their only way in. Switching it off, changing its address, or replacing its credentials did the same damage and went straight through, and a link to a provider that had since been deleted or switched off counted as a way in, which made the guard fall silent entirely for the affected accounts.
• Three more holes, all closed: the sign-in cookie carried no Secure and NEXVIEW_COOKIE_SECURE never reached it; a confirmation from userinfo could vouch for a different address than the one being used; and an identity token issued for a different application was accepted because azp was not checked.
• A refused sign-in now says why. It used to say nothing at all: the person got a deliberately vague message and the log stayed silent, so an operator whose provider reports email_verified: false (the factory setting at authentik, Keycloak and Pocket ID) had nothing to go on. Every refusal now names the reason, the issuer, whether an address arrived and whether an account exists for it, with addresses shortened.
• A provider can be corrected in the interface. Until now a mistyped client secret could only be fixed by deleting the provider and adding it again. Children's wishes and requests
• A child's wish could only be declined once the film had already arrived, the one answer that tells the child the opposite of the truth. Such a wish is now closed as fulfilled. Wishes whose film arrived through somebody else's request no longer stay open forever, and deleting a child account no longer leaves its wishes behind.
• Approving a film that Radarr already held failed for good, a failed request had no button left at all, and two messages arrived in German regardless of the language you had set.

Changed

• The approval list says which child a request came from.
• "Searching for over 14 days" no longer reports films that have not come out yet.
• The "test phase" notice above the storage quotas is gone.

Under the hood

• The first visit is 47 kB lighter.
• The README now documents the email_verified trap, Authelia and Zitadel, what Nexview reads from a token, and that groups are deliberately ignored.