ZL154/AchievementBadges_for_Jellyfin v2.0.2 on GitHub

v2.0.2 — Standalone page endpoint + CI maintenance.

Small iterative release. Adds a thin HTML shell route for the existing standalone bundle, plus the usual dependabot CI bumps.

What's new

GET /Plugins/AchievementBadges/StandalonePage — an anonymous endpoint that returns a minimal HTML document hosting the achievements UI without the surrounding Jellyfin Web shell (no sidebar, no top bar). The caller supplies the access token + user id (+ optional server id) via query string; the page seeds the standard jellyfin_credentials localStorage entry the existing standalone.js bundle's credential resolver already picks up, then loads the bundle. Same data, same REST API as the in-Jellyfin admin page — different shell.
- URL format:
```
https://YOUR-HOST/Plugins/AchievementBadges/StandalonePage?token=<accessToken>&userId=<userGuid>
```
- Anonymous endpoint; the security gate is the supplied token itself.
- Query parameters are passed through a strict whitelist sanitiser (drops quotes, backslashes, line breaks, and ASCII control characters) before being interpolated into the seed-localStorage JavaScript, so they cannot escape the single-quoted string context.
- Response carries Referrer-Policy: no-referrer (kills the Referer token-leak on any outbound click from the page) plus Cache-Control: no-store, no-cache, must-revalidate, max-age=0 + Pragma: no-cache + Expires: 0 (so a revoked token can't keep surfacing from proxy or browser caches).
- Security note: access tokens in URLs are visible to reverse-proxy access logs, browser history, and any outbound Referer leak that survives the policy above. Only use this endpoint for scopes where that exposure is acceptable.

Maintenance

CI bumps merged from dependabot:
- actions/setup-dotnet 5.2.0 → 5.3.0 (#22)
- github/codeql-action 4.35.5 → 4.36.0 (#21)
- gitleaks/gitleaks-action 2.3.9 → 3.0.0 (#23)
- oss-fuzz-base/base-builder digest pin bump (#20)

Upgrade

Drop-in upgrade from v2.0.1 or v2.0.0. No schema breakage, no config changes required. No data migration.
43/43 tests pass on .NET 9 / Jellyfin 10.11.10.
The standalone.js bundle path the new endpoint references (/Plugins/AchievementBadges/client-script/standalone) was already present in v2.0.1 — this release only adds the HTML wrapper that knows how to seed credentials and load it.

Verification

gh attestation verify Jellyfin.Plugin.AchievementBadges_2.0.2.0.zip --owner ZL154
cosign verify-blob --certificate Jellyfin.Plugin.AchievementBadges_2.0.2.0.zip.pem \
    --signature Jellyfin.Plugin.AchievementBadges_2.0.2.0.zip.sig \
    --certificate-identity-regexp "https://github.com/ZL154/AchievementBadges_for_Jellyfin/.*" \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    Jellyfin.Plugin.AchievementBadges_2.0.2.0.zip