v0.9.0 — Pro-Sync wave (retag)

The headline is the Pro → Community feature-sync wave: six PRs that bring Community within reach of Pro's non-commercial feature surface, with an upsell teaser everywhere the full Pro feature stays Pro.

Note on the tag: this release reuses the v0.9.0 tag. The earlier v0.9.0 (dated 2026-10-13) shipped the full English UI (#95) + post-v0.8.0 catch-up content; that content is still in this release, folded in below. The six Pro-Sync items below are new.

Phase A — Low-Risk CORE

• A.1 Password-Reset-Flow + Admin → Mail (SMTP) (#107 / [#113])
• Public /reset_request + /reset_form routes, no account enumeration, rate-limited.
• Tokens are SHA-256-hashed, single-use, 1 h TTL; a successful reset invalidates every sibling.
• Admin → System → Mail (SMTP) card: configure From/host/port/user/pass + none/STARTTLS/SSL. Blank host falls back to PHP mail(). Native SMTP client via stream_socket_client (no new Composer deps). "Send test email" button.

• "Forgot password?" link under login.

• A.2 Admin → Importe-Übersicht (#108 / [#114])

• import_batches now carries a nullable user_id so the admin page can show who imported what; legacy rows stay as "unbekannt".

• Filter row (user + date range) + Details sub-view listing the entries created by a given batch.

• A.3 Admin → Scheduler / Cron (#109 / [#116])

• New Scheduler class + scheduler_runs state table.
• Built-in jobs: prune_expired_reset_tokens (hourly, wires A.1) and prune_rollback_snapshots (daily, cleans the Updater's data/backup_* tail).
• Admin → Scheduler status page with "run now" per job.
• Public ?r=cron_web_run&token=… endpoint for external cron hitters (shared-hosting friendly), constant-time token verify. See README's new "Scheduler (housekeeping jobs)" section.

Phase B — Soft Upsell

• B.1 Static holiday overlay in the week calendar (#110 / [#118])
• DACH set (DE + AT + CH union, 16 entries with scope badges) for de; US federal set (11 entries) for en.
• Easter via easter_date() with an Anonymous-Gregorian fallback; nth-weekday rules for Thanksgiving / Memorial / Labor / MLK / Presidents / Columbus Day.
• Pinned-date regression tests for 2024-2026.

• No external calendar sources — CalDAV / iCal stays Pro.

• B.2 Projekt-Soll-Stunden (simple project planning) (#111 / [#119])

• New nullable projects.target_hours. Edit-form field + list column (120,5 or 120.5 accepted).
• Dashboard "Projekt-Planung" card with tri-color progress bar: ok (< 80 %) / warn (80-100 %) / over (> 100 %).

• Weekly/monthly/per-person breakdown and Gantt stay Pro.

• B.3 Projekt-Report Ist vs Plan (#112 / [#120])

• New /report/projects route + inline-SVG bar chart (no JS chart library) + CSV export.
• Filter row: client + date range.
• Budget-in-€, delay report, PDF export and heatmap stay Pro.

Also in this tag (carried over from the 2026-10-13 v0.9.0)

• Full English UI support (#95) — the German-only Community edition is now bilingual, user-switchable in session.
• Post-v0.8.0 catch-up: README rewrite + hero art, light-mode screenshots, Team-Sentiment page, cascading task picker, four side-panel improvements.
• Zeit-Check user-survey campaign + in-app banner (#115, merged to main after the earlier v0.9.0 tag).

Upgrade notes

• SQLite / MySQL migrations are idempotent + portable. The on-boot migrator picks them up automatically. Nothing on-disk to touch manually.
• New permission codes: none. The admin surfaces reuse the existing admin.system and admin.imports; the report is gated by structure.manage.
• The Scheduler is optional. If you don't configure a cron hitter the jobs just never fire; the overview page tells you so.

Tests

128 tests, 411 assertions, all green.

🤖 Generated with Claude Code