- Default font changed to Nunito (id 6)
- Containers auto-inject "Title" + "Text here" subtitle on draw (grouped)
- MCP create_element defaults to title/subtitle card layout for containers
- Sync preserves element geometry (x/y/width/height) across refreshes
- normalizeForBackend preserves native bound text instead of collapsing to label.text
- Rate limits raised to 500 req/15min general, 30 req/min sync writes
- Draggable "Font px" widget with localStorage position persistence
- Left panel widened for full Opacity visibility
- Updated rate-limit tests to match new limits (30 write, 500 general)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- 9 backend security test files (auth, headers, rate-limit, middleware
order, smoke, validation, WS auth, integration bootstrap)
- 1 e2e test (clear-preference)
- SECURITY.md policy doc
These files powered the 369-test suite but were never committed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
