Changelog

83890a7: Repository-wide cleanup.

• Header shows the signed-in state on prerendered pages. A small <account-menu> element fetches the session once per page and swaps the “Sign in” link for the account and admin links; server-rendered pages still get it from Astro.locals.
• Admin inbox can be filtered by notification status (?delivery=failed, linked from the dashboard); statuses use readable labels (New, Read, Archived; Pending, Sent, Failed, Skipped) and share one pagination component with the blog and users pages.
• Docker image ships scripts/migrate.ts so migrations run with production dependencies only (docker run --rm --env-file .env astro-framework node scripts/migrate.ts); Drizzle Kit, the adapters and the other build-time packages are now dev dependencies.
• Retention job moved into src/lib/retention.ts with unit tests; pnpm db:prune prints what it removed.
• Smaller surface: unused exports (requireEnv, pruneThrottle, POSTS_PER_PAGE, the EmailNotConfiguredError class, re-exported auth client helpers) and stale configuration (.npmrc, .node-version, wrangler types on every Cloudflare build) are gone; CI installs through one composite action and caches the Playwright browser.
• Copy, comments and docs were rewritten to describe the current behaviour without history.

e126ecd: Admin hardening.

• Authorization is read from the database for the admin pages, the admin actions and the account export (getAuthoritativeSession()), instead of the five-minute session cookie cache. Removing the admin role, banning or “sign out everywhere” now applies to the very next request.
• Opening a message no longer mutates on GET. Marking a message read is an audited POST action triggered when a person opens it (or via the new “Mark as read” button); inbox links disable prefetching. Previously Astro’s viewport prefetch marked every visible message read.
• Inbox pagination and search: 25 messages per page with “Showing x–y of n”, plus a filter by sender name or email. “Mark as unread”, read/archive/delivery timestamps on the detail page and a confirmation notice after every admin action.
• Last-admin protection: the last active administrator cannot be demoted, banned, deleted or delete their own account; pnpm admin:promote --revoke refuses without --force.
• Audit log: message actions and their entries are written in one transaction (writeAudit()); Better Auth user operations stay best-effort and the UI and docs say so.
• /api/health returns only status and time to anonymous callers; administrators and requests with Authorization: Bearer <HEALTH_TOKEN> get the full checks.
• CONTACT_MAX_AGE_DAYS (optional) lets pnpm db:prune enforce a maximum age for messages of any status; the privacy policy and guide describe the retention rules precisely.

9097054: Operational completeness:

• Email safety. Without RESEND_API_KEY, production requests now fail instead of printing sign-in links to the logs; the magic-link and password-reset UI is hidden until email is configured. Production deployments also validate BETTER_AUTH_SECRET at startup.
• Contact flow. The honeypot works as documented, submissions are throttled per address and per IP with a persistent store, messages are stored before the owner notification is attempted, delivery status is recorded and retries never duplicate a message.
• Admin area (/admin) with a message inbox (read, archive, delete, resend notification), user management through Better Auth’s admin plugin (roles, bans, session revocation, deletion) and an audit log. Administrators come from ADMIN_EMAILS or pnpm admin:promote.
• Account self-service. Email verification (required when email is configured), password reset, change password, data export and account deletion from the dashboard, plus a retention job (pnpm db:prune) and a privacy policy that matches the product.
• Fixes. Forms recover from network errors, sign-out reports failures, the sign-up page keeps the next destination, the login copy reflects the configured methods, the theme toggle announces its action, docs carry real publication dates and the homepage shows installed versions from the lockfile.