Movie Roulette Release Notes

Major Feature: HeroUI Theme

Full Integration: Modern glassmorphism and effects applied to all pages, including Settings, Collections, and Login.
Default Active: The theme is now enabled by default via the USE_HEROUI_THEME variable.

Now Watching Card: Real-time playback status on the main page with progress tracking and PNG sharing.
Grid View Overhaul: New card layout featuring hover-to-play overlays and a current-set shuffle mode.
Seerr Service Migration: Merged Overseerr and Jellyseerr into a single unified "Seerr" request service.
Integrated Cache Management: Moved service and user cache tools into the main Settings sidebar for admins.
In-App Media Details: Collections movie titles now open internal overlays instead of external TMDb links.
Unified Navigation: Combined desktop and mobile menus to ensure full page access on small screens.
Mobile Button Fix: Restored Grid View and Collections buttons previously hidden in the legacy mobile theme.
iOS Tap-to-Top: Status bar taps now smoothly scroll active modals and filmography back to the top.
Cast Display (Issue #58): Limited display to 4 actors to prevent layout wrapping on posters and screensavers.
Markdown Release Notes: The update notification popup now renders formatted markdown for better readability.
Other UI Enhancements: Added service-specific SVG logos, improved user role badges, and added total movie counts to the collections search.

Collections Playback: Fixed failed playback caused by sending TMDb IDs instead of library IDs.
iOS Search Zoom: Set 16px font minimums to prevent browser auto-zoom on search inputs.
Session Purging: Resolved a bug where expired sessions were never deleted from the database file.
Grid Mismatches: Fixed an issue where movie cards occasionally opened details for the wrong film.
Jellyfin Metadata: Fixed "Unknown" video and audio formats in poster and screensaver modes.
Playback Tracking: Resolved poster hijacking and start-time drift during stream resumes.
Trakt Sync: Fixed token refresh failures and resolved incorrect unwatched warnings.
Asset Handling: Replaced missing actor photos with SVG placeholders to stop 404 network errors.
Filter UI: Implemented immediate count updates when switching between media services.

Runtime Upgrade: Upgraded to Python 3.12 and Debian Bookworm for the latest security patches.
API Hardening: Enforced authentication requirements on 38 previously exposed endpoints.
Password Security: Migrated to PBKDF2-HMAC-SHA256 hashing and enforced an 8-character minimum.
Brute-Force Lockout: Accounts now lock for 15 minutes after 5 failed login attempts.
Credential Masking: API keys and tokens are now stripped from settings responses.
Trakt PKCE: Migrated OAuth flow to PKCE for more secure token exchanges.
Security Headers: Added XSS, CORS, and Referrer-Policy protection to all responses.

USE_HEROUI_THEME: Toggle the HeroUI/Aceternity interface (Default: TRUE).
SHOW_NOW_WATCHING_CARD: Toggle the main page playback card (Default: TRUE).
SEERR_URL / SEERR_API_KEY: Unified variables for Seerr-compatible services.
CORS_ALLOWED_ORIGINS: Define allowed origins for WebSocket connections (Default: *).

Full Changelog: v5.1.2...v5.2.0