What's fixed
The app-passwords UI added in v4.0.31 was completely non-functional. The Create button silently reloaded the page without creating anything. v4.0.35 fixes it. Resolves #109 (reporter: @droM4X — thank you for the fast bug report).
If you tried app passwords on v4.0.31 / .32 / .33 / .34 and saw the page reload with no token shown — that was the bug. Pull v4.0.35 and try again; the form will work as documented.
Root cause
The new UI was placed inside the existing profile-save outer <form> in user_edit.html. HTML5 doesn't allow nested <form> elements — browsers silently ignore the inner tag and submit the OUTER form when an inner button is clicked. So Create posted to /me (profile save) instead of /me/app-passwords (the create endpoint), the label was dropped, and the page just reloaded.
docker pull ghcr.io/new-usemame/calibre-web-nextgen:v4.0.35
Regression coverage
4 new tests pin the no-nested-forms invariant via HTMLParser depth tracking, including a stronger pin that asserts the app-password Create form opens at outer-form-nesting-depth 0 specifically. Any future contributor who tries to add a <form> inside the profile-save form trips them at CI.
Credits
Bug report: @droM4X. Fast report → fast fix.