Revert the client styling from the swimlane title-color matching change and the
card title-color matching change. Swimlane controls again use neutral gray and
darker hover colors, and card controls regain their previous styling. Remove the
shared card-control class and the added light-card title overrides.

Updated source guards cover the restored colors and retained card palette.
Four live checks in Chromium and Firefox verify swimlane normal/hover colors and
card controls on colored backgrounds at testi.wekan.fi.

The earlier session-upgrade repair repeated a token login that Accounts had
already started. Live DDP diagnostics reproduced the remaining symptoms of
#6677: the user ID remained logged
in, but rebuilding subscriptions cleared the published profile. The saved
profile in the database was unchanged. This is separate from control CSS.

Move the existing credential and expiry into Accounts' memory store, remove its
old persistent copy, synchronize the token poll and let the native validated
endpoint set the HttpOnly cookie. Do not repeat the initial login. Cookie-only
clients continue using the native cookie resume.

Unit scenarios cover completed and pending initial logins and cookie-only
startup. The extended live regression checks the name, loaded avatar and theme
past the three-second poll, edits the name and theme, favorites the board,
switches to list view and verifies persistence after a cookie-only reload.
Both Chromium and Firefox pass this regression and the private-board refresh
check. Native Edge, AD authentication and WebKit were not exercised.

The Upcoming coverage audit ran all Node suites: 858 checks passed, with the
same two pre-existing failures for an undocumented test-results directory and
Finnish rule-description wording. All three targeted color/session suites pass.

Remove the Legacy HTML4 and Legacy Omi progressive browser interface, its
cookieless sessions, page controllers, assets and parity refactors. Page requests
again use the standard Meteor interface and the previous browser operations.
The HTML4 design documents, paused-work backlog and feature tests are removed.

Intervening translation updates, backup screenshots, session-upgrade repairs,
cryptographic test identifiers, local image storage, searchable document previews
and browser lazy loading remain. Shared GIF utilities now live in an independent
image module so the retained image features have no HTML4 dependency.

The Node suite run and targeted reruns pass apart from two failures reproduced
with the previous code: an undocumented existing test-results directory and a
Finnish rule-description expectation. Five new interface and image checks pass;
121 changed application modules parse and their 1,001 local imports resolve.
Live validation at testi.wekan.fi passes eight checks in Chromium and
Firefox: standard sign-in, JavaScript-disabled responses, member board loading
and non-member denial. WebKit cannot launch with the available system libraries.
Existing suites cover the retained Upcoming features, session repair, build fix,
keyboard navigation and email documentation.

HTML export and its ZIP writer now load only after the HTML Export action is
clicked. The direct JSZip dependency is removed; export uses the same small MIT
fflate implementation as server-side document conversion, while ZIP imports
continue through the bounded streaming server route. Gantt no longer imports an
unused Markdown parser, and attachment UI no longer loads BSON merely to create
or display an identifier. Tests keep the feature boundary dynamic, prevent the
duplicate ZIP library from returning, and cover the import/export paths.

Trello package import no longer relies on an undeclared JSZip copy. It uses the
same server-side unzipper reader as the bounded backup and scoped-import paths,
while retaining path, entry-count, expanded-size and per-file limits. This leaves
fflate as the small lazy browser/document ZIP implementation and unzipper as
the server reader for large streamed input.

Upgrading from v11.39 no longer replaces the browser's existing resume-token
store before that token has migrated to the new HttpOnly cookie flow. The
three-second Accounts token poll therefore cannot log out the restored user and
remove their reactive name, avatar, theme, favorites and board-view settings.

Static positive and negative coverage pins the migration order and forbids
direct token writes. A Chromium regression recreates the old local-token state,
checks the profile and board view, and remains logged in beyond the poll window.

Tab now moves directly from each sign-in or sign-up writing field to the next
one below it without stopping on a show/hide-password control. The controls
remain available by pointer and assistive technology. Native Enter submission
remains active in the bottom field. Source and three-browser tests cover the
positive field order, the skipped controls, failed-login submission and
successful account creation.

PDF, DOCX, XLSX and PPTX previews are now generated on the server and cached in
Default Storage. Plain Unicode text is stored without formatting in a separate
unpublished searchText field, displayed as selectable text, and exposed to a
board-authorized attachment-text search method. Embedded document images and PDF
page imagery are converted to GIF; page controls browse the combined lightweight
representation.

Source bytes, decoded text, page count, archive entries and expanded OOXML data are
all bounded. ZIP entries are streamed, malformed images do not suppress readable
text, generated data is tied to the original checksum, and every manifest, image
and search request repeats board-read authorization. The small conversion stack is
MIT and Apache-2.0 only; no GPL, LibreOffice, Ghostscript, browser runtime or OCR
dependency is added. Tests cover the storage split, authorization, regex escaping,
selectable safe rendering, GIF routes, size limits, licenses and vulnerable-version
exclusions. Sharp is updated to 0.35.4 so untrusted image decoding also receives the
current libvips security fixes.

Admin Panel instance and Organization branding now offers image upload controls
instead of editable external image URL fields. Every upload is authorized, bounded,
decoded and converted to GIF on the server before it is written to Admin Panel /
Attachments / Default Storage. Direct REST and tenant-setting writes cannot restore
an arbitrary image source URL. The separately configured logo click destination is
unchanged.

At startup, existing external login logos, header logos and board backgrounds are
downloaded through the SSRF-safe fetcher, converted to GIF and atomically replaced
with internal URLs. A failed legacy download is removed immediately from client-
visible data and retained only in an unpublished retry queue for the next startup.
Board Settings likewise offers only upload, unset and the stored-background list;
new board backgrounds pass through a board-admin-checked GIF conversion method.
Offline imports no longer activate third-party background URLs. Regression coverage
checks authorization, input limits, SSRF-safe migration, Default Storage selection,
GIF-only output, response hardening, hidden URL write paths, board-background upload
and import behavior.

Playwright readiness selects HTTPS for a public HTTPS test URL. The board
non-member regression waits for the rendered denial and absence of the canvas,
so the development server's persistent SockJS polling cannot cause a false
network-idle timeout. The HTTPS guard and eight live Chromium/Firefox checks pass.

All Playwright fixture usernames, addresses, object identifiers and run markers
now come from one Node crypto.randomBytes helper instead of Math.random.
This resolves CodeQL alerts 450 through 522 and prevents predictable randomness
from becoming normalized in tests that exercise authentication and authorization
boundaries.

A source regression scans every Playwright helper and specification, requires
the shared helper to remain CSPRNG-backed and refuses any executable
Math.random() call. The retained files pass JavaScript syntax checks; the removed HTML4 browser
specifications no longer form part of this coverage.

The isomorphic change-history integrity helper now computes synchronous SHA-256
without importing Node crypto, so client tests no longer pull in
crypto-browserify and fail on its unresolved vm and stream modules. Test
vectors compare the implementation with Node's SHA-256, and the compiled client
source map is free of the former dependency chain. The language-loading test
now checks i18next state without a dynamic require warning. Test-run signal
handlers disarm themselves before cleanup, preventing repeated Ctrl-C presses
from recursively restarting port cleanup.

Snap help, every current Docker Compose example, Unix and Windows start scripts,
and the VirtualBox launcher now explain above MAIL_URL that enabling Enable
below email settings at Admin Panel / People / Email reveals the additional
email sending options. A regression check keeps that guidance present and in
the correct order across every deployment example.