Merge remote-tracking branch 'origin/main' into copilot/clean-up-repo-extra-files

 Conflicts:
	.eslintrc.json
	.gitignore
        Adam's_Hearty_Lentil_&_Vegetable_Soup.json
	Adam's_Ultimate_Vegan_Grilled_Cheese.json
	linuxarch101.md
	sample_sessiondata.json

 It looks like you may be committing a merge.
 If this is not correct, please run
	git update-ref -d MERGE_HEAD
 and try again.

Please enter the commit message for your changes. Lines starting
with '#' will be ignored, and an empty message aborts the commit.

 On branch copilot/clean-up-repo-extra-files
 Your branch is up to date with 'origin/copilot/clean-up-repo-extra-files'.

** All conflicts fixed but you are still merging.**

 Changes to be committed:
	modified:   .agent/skills/dependency-auditor/test-project/package.json
	modified:   .claude/skills/dependency-auditor/test-project/package.json
	modified:   .codex/skills/dependency-auditor/test-project/package.json
	modified:   .cursor/skills/dependency-auditor/test-project/package.json
	modified:   .gemini/skills/dependency-auditor/test-project/package.json
	modified:   .github/dependabot.yml
	modified:   .github/skills/dependency-auditor/test-project/package.json
	modified:   .github/workflows/ci.yml
	new file:   .github/workflows/codeql-analysis.yml
	modified:   .github/workflows/daily-repo-status.lock.yml
	modified:   .github/workflows/dependabot-automerge.yml
	new file:   .github/workflows/dependency-review.yml
	modified:   .gitignore
	modified:   .zed/skills/dependency-auditor/test-project/package.json
	modified:   AGENTS.md
	modified:   Backend
	modified:   COPILOT.md
	modified:   QUICK_REFERENCE.md
	modified:   README.md
	modified:   START_HERE.md
	modified:   docs/cloud_build_tips.md
        modified:   docs/cloud_build_tipsFORMAT.md
	modified:   metadata.json
	modified:   package-lock.json
	modified:   package.json
	modified:   server/index.ts
	modified:   src/app.component.html
	modified:   src/app.component.ts
	modified:   src/services/auth.service.ts
	modified:   src/services/gemini.service.ts
        modified:   src/services/persistence.service.ts
	modified:   tsconfig.json

 Untracked files:
	.clawhub/
	.eslintrc_BACKUP_1763037.json
	.eslintrc_BASE_1763037.json
	.eslintrc_LOCAL_1763037.json
        .eslintrc_REMOTE_1763037.json
	claude-code-tresor/
	skills/

-- half way there,

Author: adamtasteslikegood

.agent/skills/dependency-auditor/test-project/package.json

@@ -28,7 +28,7 @@
     "express-rate-limit": "6.7.0",
     "multer": "2.1.1",
     "sharp": "0.32.6",
-    "nodemailer": "7.0.11",
+    "nodemailer": "8.0.4",
     "socket.io": "4.6.2",
     "redis": "4.6.5",
     "moment": "2.29.4",

.claude/skills/dependency-auditor/test-project/package.json

@@ -28,7 +28,7 @@
     "express-rate-limit": "6.7.0",
     "multer": "2.1.1",
     "sharp": "0.32.6",
-    "nodemailer": "7.0.11",
+    "nodemailer": "8.0.4",
     "socket.io": "4.6.2",
     "redis": "4.6.5",
     "moment": "2.29.4",

.codex/skills/dependency-auditor/test-project/package.json

@@ -28,7 +28,7 @@
     "express-rate-limit": "6.7.0",
     "multer": "2.1.1",
     "sharp": "0.32.6",
-    "nodemailer": "7.0.11",
+    "nodemailer": "8.0.4",
     "socket.io": "4.6.2",
     "redis": "4.6.5",
     "moment": "2.29.4",

.cursor/skills/dependency-auditor/test-project/package.json

@@ -28,7 +28,7 @@
     "express-rate-limit": "6.7.0",
     "multer": "2.1.1",
     "sharp": "0.32.6",
-    "nodemailer": "7.0.11",
+    "nodemailer": "8.0.4",
     "socket.io": "4.6.2",
     "redis": "4.6.5",
     "moment": "2.29.4",

.gemini/skills/dependency-auditor/test-project/package.json

@@ -28,7 +28,7 @@
     "express-rate-limit": "6.7.0",
     "multer": "2.1.1",
     "sharp": "0.32.6",
-    "nodemailer": "7.0.11",
+    "nodemailer": "8.0.4",
     "socket.io": "4.6.2",
     "redis": "4.6.5",
     "moment": "2.29.4",

.github/dependabot.yml

@@ -12,7 +12,14 @@ updates:
     labels:
       - "dependencies"
       - "github-actions"
-    open-pull-requests-limit: 25
+    commit-message:
+      prefix: "ci"
+    groups:
+      # Group all GitHub Actions updates into a single PR
+      actions-all:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 10
 
   # -------------------------
   # npm (root)
@@ -25,7 +32,45 @@ updates:
     labels:
       - "dependencies"
       - "javascript"
-    open-pull-requests-limit: 25
+    commit-message:
+      prefix: "build(deps)"
+    groups:
+      # All @angular/* packages should be updated together
+      angular:
+        patterns:
+          - "@angular/*"
+      # Testing tools (vitest, coverage)
+      testing:
+        patterns:
+          - "vitest"
+          - "@vitest/*"
+      # ESLint and related plugins
+      linting:
+        patterns:
+          - "eslint"
+          - "eslint-*"
+          - "@typescript-eslint/*"
+          - "@angular-eslint/*"
+          - "prettier"
+      # TypeScript and type definitions
+      types:
+        patterns:
+          - "typescript"
+          - "@types/*"
+      # Build tools (vite, tailwind, postcss, autoprefixer)
+      build-tools:
+        patterns:
+          - "vite"
+          - "tailwindcss"
+          - "autoprefixer"
+          - "postcss"
+    # Ignore known breaking major updates that require manual migration
+    ignore:
+      # Tailwind v4 requires @tailwindcss/postcss plugin and full config migration.
+      # Review periodically — remove this ignore when ready to migrate (see postcss.config.js).
+      - dependency-name: "tailwindcss"
+        update-types: ["version-update:semver-major"]
+    open-pull-requests-limit: 15
 
   # -------------------------
   # Docker (root)
@@ -38,4 +83,6 @@ updates:
     labels:
       - "dependencies"
       - "docker"
-    open-pull-requests-limit: 25
+    commit-message:
+      prefix: "build(docker)"
+    open-pull-requests-limit: 5

.github/skills/dependency-auditor/test-project/package.json

@@ -28,7 +28,7 @@
     "express-rate-limit": "6.7.0",
     "multer": "2.1.1",
     "sharp": "0.32.6",
-    "nodemailer": "7.0.11",
+    "nodemailer": "8.0.4",
     "socket.io": "4.6.2",
     "redis": "4.6.5",
     "moment": "2.29.4",

.github/workflows/ci.yml

@@ -10,6 +10,42 @@ on:
     branches: [main, develop]
 
 jobs:
+  format:
+    name: Format and commit
+    runs-on: ubuntu-latest
+    # Only auto-commit on direct pushes — PRs from forks cannot push back
+    if: github.event_name == 'push'
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Format with Prettier
+        run: npm run format
+
+      - name: Commit formatted files
+        run: |
+          git config --local user.email "github-actions[bot]@users.noreply.github.com"
+          git config --local user.name "github-actions[bot]"
+          if ! git diff --quiet || ! git diff --staged --quiet; then
+            git add -A
+            git commit -m "style: auto-format with Prettier [skip ci]"
+            git push
+          fi
+
   build:
     name: Build
     runs-on: ubuntu-latest

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,47 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    # Run weekly on Monday at 06:00 UTC to catch new CVEs
+    - cron: "0 6 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # JavaScript/TypeScript covers the Angular frontend and Express server.
+        # Python (Flask backend) lives in the Backend/ submodule — a separate
+        # repository that should configure its own CodeQL workflow.
+        language: [javascript-typescript]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          # Use the extended security query suite for more comprehensive coverage
+          queries: security-extended
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"