Highlights

• Reporting
• Security Fixes

What's Changed

• Reorder system settings tabs by permission hierarchy by @Noah231515 in #613
• fix(api): keep group_members.group_role nullable so upgrades can create groups by @Noah231515 in #614
• refactor(api): unify receipt read enforcement across REST and MCP by @Noah231515 in #616
• fix(api): enforce RBAC grants and paid-by visibility in MCP read tools by @Noah231515 in #615
• fix(api): stop CreateReceipt losing its transaction on read-back by @Noah231515 in #618
• feat(receipts): add a Group field to the receipt filter by @Noah231515 in #619
• feat(quick-scan): configurable quick-scan fields per group (api + desktop + mobile) by @Noah231515 in #620
• Reporting engine core by @Noah231515 in #621
• fix(roles): reconcile system-role permissions on boot (add-only) by @Noah231515 in #622
• feat(reporting): report data source by @Noah231515 in #623
• feat(pie-chart): show hidden categories/tags as a (Restricted) slice by @Noah231515 in #624
• feat(reporting): add flat CSV renderer for the ReportModel by @Noah231515 in #625
• feat(reporting): add faithful XLSX renderer for the ReportModel by @Noah231515 in #626
• feat(reporting): HTML renderer + shared faithful walk by @Noah231515 in #627
• feat(reporting): synchronous report generation endpoint + group.reports.read by @Noah231515 in #628
• feat(mobile): QR-scan the server URL on the Connect screen by @Noah231515 in #629
• feat(reporting): desktop Report Builder UI + preview endpoint by @Noah231515 in #630
• Report templates: save, delete, and version-stamp report configurations by @Noah231515 in #631
• Report templates: list, row actions, and open-in-builder hydration by @Noah231515 in #632
• Report templates: in-place update + dynamic "current viewer" paid-by filter by @Noah231515 in #633
• Report-template access control: group-scoping, per-template matrix, and -All bypass permissions by @Noah231515 in #634
• fix(reports): CSV formula-injection guard + honor -All perms in the builder by @Noah231515 in #635
• Reporting pre-merge hardening: arithmetic OOM guard + disabled-column persistence by @Noah231515 in #636
• Mobile reporting slice (list / preview / generate / delete) by @Noah231515 in #639
• feat(reporting): Report dashboard widget (view + gated download) by @Noah231515 in #640
• feat(reporting): mobile view-only Report dashboard widget + e2e by @Noah231515 in #641
• Add Claude Code sandbox setup playbooks for all components by @Noah231515 in #642
• Reporting: receipt reports — engine, renderers, Builder UI, saved templates, and access control by @Noah231515 in #637
• Add comprehensive test coverage for utility functions by @Noah231515 in #643
• Use ARM-native runner for Docker builds by @Noah231515 in #644
• Add comprehensive unit tests for models package by @Noah231515 in #646
• fix(mobile): recover iOS launch render freeze on 120Hz devices (#617) by @Noah231515 in #645
• Bump Go dependencies with known vulnerabilities by @Noah231515 in #649

Full Changelog: v7.0.0...v7.1.0