TautWeekly for Plex v0.18.0

v0.18.0 adds an optional custom text card to every maintained newsletter
package. Enable it in the Manager configuration immediately after Cache to
place a message before the newsletter release-count and date block. The card
supports a configurable border color and opacity, an optional gold title, an
optional larger white subheading, and a required plain-text body. Its layout
balances automatically when either optional heading is omitted, and the same
content appears in HTML newsletters, plain-text alternatives, generated
previews, and welcome-state output.

The Manager now gives capability-aware update status a card-level attention
glow whenever the state is not Current. The existing green Current treatment
is unchanged. The purple header update SVG remains stricter: it appears only
after a successful validated automatic or manual check proves that the running
application has a newer stable release. It continues to link to Settings >
Updates and never installs anything by itself.

Successful update results are reused for five minutes across Windows,
NAS/Docker, macOS, native Linux, and FreeBSD package kinds. This reduces
redundant upstream checks without changing the 24-hour authenticated-entry
refresh, the explicit Check now action, short failure retry backoff, or
offline-safe Dashboard and health behavior. Windows alone can start its
existing verified elevated updater; every other package retains its documented
host-owned update flow.

The release also removes the phantom grey rectangles seen in Config and
Settings. The underlying separator-backed grids now keep incomplete rows on the
same black surface. If the custom card is enabled without body text, the GUI
marks the field required and blocks Validate, save, and verify; the backend
enforces the same requirement.

Update existing installations

Back up private data, then use the documented update path for the installed
package. No configuration migration is required. The custom card is disabled
by default, so existing newsletters remain unchanged until it is explicitly
enabled. Existing credentials, schedules, generated newsletters, backups,
history, Tailscale settings, Manager access settings, package ownership, and
recovery behavior remain unchanged.

Security and privacy

Custom card content is normalized as plain text and escaped before HTML output;
it does not accept executable markup. No runtime configuration, credentials,
tokens, identities, private logs, generated newsletters, or infrastructure
details are included in the release. Update checks remain bounded and
sanitized, and no package gains new host, root, Docker, Podman, systemd, rc.d,
or package-file authority.

Validation

The release passed production and preview JavaScript syntax; Manager unit,
integration, accessibility, cross-build, configuration, update-indicator, and
update-cadence tests; active-week, quiet-week, welcome-state, plain-text, and
HTML renderer coverage; privacy, security, repository, branding, platform,
documentation, and link checks; reproducible release archives; Windows
one-click installer lifecycle tests; and amd64/arm64 container builds. Desktop
and mobile browser QA confirmed required-body gating, black Config/Settings
surfaces, conditional update SVG visibility, non-current card glow, and the
unchanged green Current treatment.