promote: dev -> main (upstream sync 2026-09-22 + auth/billing guards)

[JOY (JOY)]

What kind of change does this PR introduce?

Release promotion: dev -> main. Ships the upstream sync (75 commits of provider error-mapping fixes, clipping workflow stabilization), the DOS billing owner guard (PR #53), the auth UX fixes (PR #55: SSO auto-redirect + honest error page), and the deps/compiler fixes (#57).

Why was this change needed?

Ships the guarded billing sync (free-plan member logins can no longer wipe paid org subscriptions - the 2026-09-22 incident vector) and the auth UX fixes to production.

Technical Details & Scope

Full dev history since the last promote: PRs #52-#57 plus upstream sync. No new code authored here.

Verification & Testing

All constituent PRs CI-gated (build.yml bootstrap suites + full build + branding guard + CodeQL) and reviewed. Auth login verified live against beta (e2e suite) and prod (post-incident script). Owner-guard verified by unit suite + reviewer walk.

QA

1. CI green on this PR
2. Merge, wait for build-containers to publish the new :latest image
3. Deploy on the VM, verify healthcheck + login + subscriptions intact

Checklist:

• My code follows the project's code style and architectural conventions.
• Local verification done - all constituent PRs CI-gated and reviewed.
• Branding guard - CI gate on this PR.
• Tests - dev carries the new suites.
• Documentation updated in constituent PRs.
• No secrets included.
• QA section filled with real steps.

[gemini-code-assist]

Code Review

This pull request introduces several security enhancements, new features, and bug fixes across the codebase. Key changes include replacing makeId with a cryptographically secure makeSecureId for generating sensitive tokens and OAuth states, adding a new video clipping feature with dedicated endpoints and tools, and improving error handling and API integrations for various social media providers (such as Facebook, Hashnode, Lemmy, Reddit, and Slack). Additionally, Sentry tracing was optimized, and a detailed comparison between Postiz Cloud and Open-source was added to the README. The review feedback highlights a few important improvements: parsing the page query parameter as an integer in the clipping endpoint to prevent database type mismatches, filtering out unmapped tags in the Hashnode provider to avoid sending undefined slugs, and broadening the video extension check in the Slack provider to support formats other than .mp4.

[gemini-code-assist]

The page query parameter is typed as a number but is not parsed using ParseIntPipe. In NestJS, query parameters are received as strings by default unless explicitly transformed. Passing a string to the database service expecting a number can cause runtime database errors (e.g., Prisma type mismatches).

Suggested change

	getClippings(
	@GetOrgFromRequest() org: Organization,
	@Query('page') page: number
	) {
	getClippings(
	@GetOrgFromRequest() org: Organization,
	@Query('page', new ParseIntPipe({ optional: true })) page?: number
	) {

[gemini-code-assist]

If a tag is not found in the local tags array, tags.find(...) will return undefined, resulting in { slug: undefined }. Passing undefined slugs to the Hashnode GraphQL API can cause validation or bad request errors. It is safer to filter out any tags that could not be mapped to a valid slug.

                tags: settings.tags
                  .map((tag: any) => {
                    const found = tags.find((t) => t.objectID === tag.value);
                    return found ? { slug: found.slug } : null;
                  })
                  .filter((t: any) => t),

[gemini-code-assist]

The video check only looks for the 'mp4' substring. If a user uploads a video with a different extension (such as .mov or .webm), it will bypass this check and cause Slack's chat.postMessage to fail. Broaden the check to include other common video extensions.

Suggested change

	const hasVideo = posts?.some((post) =>
	post?.some((item) => (item?.path?.indexOf?.('mp4') ?? -1) > -1)
	);
	const hasVideo = posts?.some((post) =>
	post?.some((item) => {
	const path = item?.path?.toLowerCase() || '';
	return path.includes('mp4') || path.includes('mov') || path.includes('webm') || path.includes('avi');
	})
	);