Eliminate HTML injection from shell page and harden shell security

Merge forums-websocket-broadcast: enable SQLite foreign key enforcement

Merge remote-tracking branch 'github/forums-websocket-broadcast'

Route GIN web logger through logWriter to get consistent timestamps and stop logging query parameters (which leaked JWT tokens)

Merge branch 'main' into forums-websocket-broadcast

Invalidate cached app DB connections on version change to ensure schema migrations run after hot-reload

Merge branch 'main' into forums-websocket-broadcast

Enable foreign key constraints in SQLite database initialization

Return graceful values instead of crashing Starlark on runtime errors (stream EOF, write failure, permission denial, rate limits)

Remove url: permission check from mochi.rss.image() so OG image fetches work without per-domain grants

Remove noisy debug log from app install endpoint

Fix iframe detection tests to use fresh gin contexts (query param caching)

Remove arbitrary cap on interests.top/bottom API and fix iframe detection for cross-site navigations

Add shell progress bar for app loading and smooth iframe transitions

Bump to 0.3.85, clean up directory download logging, and expose user on scheduled event wrapper