release: 0.49.0 — R2 guardrails & test net

Internal-only epic (gates, tests, compiler strictness); no user-facing change, so
the release note is chores-only. Bundles: the siftlode check/publish gate
(tsc/eslint/prettier/knip/vitest/pytest) with a hard pre-publish gate + e2e
freshness guard, ESLint flat config + one-time Prettier pass, the backend pytest
harness (isolated test image), frontend vitest growth, the e2e scroll-restore fix,
and noUncheckedIndexedAccess (+ the zero-fallout compiler flags).

VERSION

@@ -1 +1 @@
-0.48.0
+0.49.0

frontend/src/lib/releaseNotes.ts

@@ -14,6 +14,17 @@ export interface ReleaseEntry {
 }
 
 export const RELEASE_NOTES: ReleaseEntry[] = [
+  {
+    version: "0.49.0",
+    date: "2026-07-21",
+    summary:
+      "Groundwork: a quality gate and the project's first backend tests. Nothing changes on screen.",
+    chores: [
+      "Every change now passes an automatic gate before it can be published: type-checking, linting (ESLint + ruff), formatting (Prettier), and the test suites. Releases can no longer go out over code that fails a check.",
+      "The backend gained its first tests (title cleanup, download path safety incl. the traversal guard, and the share-link signatures), and the frontend test net grew; the end-to-end browser suite is wired into the release gate.",
+      "The TypeScript compiler was tightened (notably checked indexed access), catching a class of possible-undefined mistakes across the app before they can ship. All behaviour is unchanged.",
+    ],
+  },
   {
     version: "0.48.0",
     date: "2026-07-21",