- Stop logging submitted password forms to the browser console - Drive analytics from NEXT_PUBLIC_UMAMI_* instead of a hardcoded vendor script URL and site ID; renders nothing when unset - Replace the wildcard image remote host "**" with an explicit allowlist (adds DigitalOcean Spaces) - Fix the socket URL fallback to the API port (:3001, was :4000) - Replace placeholder and personal contact emails with support@re-quest.com, including the privacy policy and terms pages Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>