chore(release): promote main to production

Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.

config/ui.tsmodified+16-1

Changes to config/ui.ts

		⋯126 linesShow the 126 lines above this hunk@@ -127,7 +127,22 @@ export default {
127	127	// allowPatterns therefore stays EMPTY.
128	128	strict: {
129	129	enabled: true,
130		- failOnViolation: false,
	130	+ // Hard-fail on a prohibited DOM call in a developer's own environment,
	131	+ // warn everywhere else. An ALLOWLIST deliberately, not `!== 'prod'`:
	132	+ // APP_ENV is typed 'local'|'dev'|'stage'|'prod' (config/env.ts) with no
	133	+ // 'production' member, and .env ships 'development', which is outside
	134	+ // that enum -- so any predicate written against 'production' is TRUE in
	135	+ // production, the exact inversion this guards against. An unset APP_ENV
	136	+ // falls through to warn-only for the same reason: a missing variable must
	137	+ // not be what turns a page into a 500. That covers the real production
	138	+ // path twice over: APP_ENV ships dotenvx-encrypted in .env.production, so
	139	+ // it arrives either decrypted as 'prod' or, if the key is missing, as the
	140	+ // literal 'encrypted:v2:...' string — and neither is in the list.
	141	+ //
	142	+ // A violation under this flag is a real HTTP 500 with the custom /500 page
	143	+ // (bun-plugin-stx serve.js:11111,11133), not a blank 200 -- verified
	144	+ // against the installed copy.
	145	+ failOnViolation: ['local', 'dev', 'development'].includes(process.env.APP_ENV ?? ''),
131	146	allowPatterns: [],
132	147	},
133	148