- Stop logging submitted password forms to the browser console
- Drive analytics from NEXT_PUBLIC_UMAMI_* instead of a hardcoded vendor
script URL and site ID; renders nothing when unset
- Replace the wildcard image remote host "**" with an explicit allowlist
(adds DigitalOcean Spaces)
- Fix the socket URL fallback to the API port (:3001, was :4000)
- Replace placeholder and personal contact emails with support@re-quest.com,
including the privacy policy and terms pages
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
