pnpm audit reports a critical advisory for next >=16.0.0 <=16.4.0:
unauthenticated remote code execution through the Image Optimization
API when SVG files are used. progmasoft.com runs 16.3.8. The site sets
no images option and the optimizer refused an SVG request in a check
from outside, but the version is in the affected range, so it moves to
16.4.2, the latest patch release; eslint-config-next follows.

Verified: pnpm check, pnpm test:coverage, pnpm lint and pnpm build
pass; pnpm audit --audit-level high reports nothing beyond the one
advisory already ignored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Serve the Progmasoft mark as a BIMI logo

BIMI lets mail clients show a sender's logo next to messages from a
domain whose DMARC policy is enforced; progmasoft.com already publishes
p=quarantine with pct=100. The BIMI record points at an SVG on the
domain, so the site now serves one at /bimi/logo.svg.

The file is SVG Tiny Portable/Secure, as BIMI requires: version 1.2,
baseProfile tiny-ps, a title, no scripts, no external references and
no x or y on the root. It draws the same four tiles as the Brand
component, in the same colours (#3b4658, #1e7188, #7655fa, #dc7644)
and the same tile-to-gap ratio (11:2, here 132 and 24 on a 512 grid),
on a white square. The mark stays inside the circle that clients crop
the logo to.

Next.js serves files from apps/web/public before the dynamic routes;
the deployment already copies public/ next to the standalone server.

Log why a Google callback could not finish

A failed Google callback has returned the visitor to /login?google=failed
since the previous release, but nothing recorded why: a declined consent,
an expired or missing state cookie and a forged request all looked the
same, and the log of the service held no entry at all.

GoogleSignInFailure now handles OnRemoteFailure. It writes one warning,
event GoogleSignInFailed (id 5), with the cause: the error code Google
reported, such as access_denied, or the reason the handler refused the
callback, such as "The oauth state was missing or invalid." An error code
is written only when it is a short run of letters, digits, '_', '-' and
'.'; anything else from the query string is written as an unrecognized
error. The authorization code, the state and tokens are never logged.
The redirect is unchanged.

Four new tests cover the entry, the redirect, an unusual error value and
a refused state. The account API document describes the log entry.

Keep account sessions for 30 days

Return a failed Google callback to sign-in and correct stale statements

A session of a Progmasoft Account, whether opened with a password or with
Google, lasted 12 hours from the sign-in, and the setting could not raise
it beyond 7 days. Sessions now last 30 days by default, and
AccountSessions:LifetimeHours may set anything from 1 hour up to that new
maximum of 720 hours; a value outside the range is clamped to it, as
before.

The lifetime stays fixed from the sign-in; it is not extended by use. The
production environment file sets no lifetime, so the new default applies
there once the API is deployed. Sessions opened before keep the expiry
they were given.

New tests check the 30-day default and the clamping of 0, 12, 720 and
10 000 hours. The account API document gives the new default and range.

A Google callback that could not finish ended in an unhandled 500: a
visitor who declined on Google's consent screen, a callback whose state
cookie had expired, and a direct request to the callback path all got an
empty error page. The account API document already promised a redirect
to /login?google=failed for a failed callback; the handler of the Google
scheme now does that through OnRemoteFailure. Three new tests cover a
callback without state, a declined consent and a forged state.

Three statements no longer matched the sites:

- the bug report template still named the catalog paths without the
  language and the build system; they are /langs/tala/<Publisher>/<Name>/
  and /dslplugins/tazel/<Publisher>/<Name>/;
- the operations guide placed Tala content on xsharp-lang.xyz, which only
  redirects to tala.run now;
- the architecture guide described the ViGet routing before the catalogs
  per language and build system: it now gives the rewrites of /langs/tala
  and /dslplugins/tazel, the redirects of /langs and /dslplugins, three
  indexed ViGet pages and a sitemap with the home page and both catalogs.