📝 Update Mailgun settings references to API security

• Update docs to link to Mailgun's API security page
• Remove redundant click tracking instructions from build page
• Update help text for mailgun_api_key and mailgun_webhook_signing_key to reflect Mailgun's renamed "API security" settings path

🔐 Verify Mailgun webhooks and block javascript: click XSS

Unsigned click webhooks could create arbitrary PmailLink URLs rendered to org admins; require HMAC signatures and allow only http(s) links.

Review bugs since the last successful workflow run

Upgrade Claude Code workflows to Opus 5.

✨ Allow free tickets by setting minimum price to 0

Update ticket price validation and input field to accept 0 as a valid price, enabling the creation of free tickets. Previously, the minimum price was 1, which prevented offering complimentary tickets.

🐛 Prompt for a price before ticket quantity selection

Explain why variable-price quantity selectors are disabled so customers know how to enable them.

🐛 Prevent notification creation when gathering is nil or being destroyed

The after_destroy callback now checks that gathering exists and is not flagged for destruction before creating a notification, avoiding potential errors and dangling references.

🐛 fix variable price ticket validation and range clamping

• Validate submitted price is finite to prevent NaN/infinity values
• Clamp prices within ticket_type.range when defined
• Add minimum price check (>= 1) for variable price tickets without a range
• Fix payment_completed logic to correctly mark variable price tickets as unpaid when no price is submitted
• Extract price calculation in purchase_helper for clarity

Notify facilitators of waitlist registrations when order notifications are on.

✨ Improve Meta Pixel tracking and shared analytics helpers

Validate pixel IDs, dedupe Purchase on refresh, add ViewContent, and extract shared analytics/Facebook pixel code.

🐛 Fix WhatsApp transcription when media URL has no file extension

Whisper infers audio format from the filename; force .ogg, use OpenAI::Client, and raise on blank transcripts so failures surface in Sentry.

🔒️ (models): add protected_attributes to multiple models to prevent mass assignment of sensitive fields
✨ (models/tactivity.rb): add validation to ensure space and tslot belong to the same timetable
🐛 (models/tactivity.rb): only set timetable from space if not already set to avoid overwriting existing value
🔥 (app/views/budget/_build.erb): remove reimbursed checkbox from budget build form as it's no longer needed

🦺 Prevent reassigning organisation and account on existing records

Add validation to Activity and LocalGroup models to prevent changing organisation_id and account_id after persistence. This ensures data integrity by preventing accidental reassignment of these critical associations.

Also add protected_attributes class method to expose the list of attributes that should not be modifiable after creation.

Include tests to verify the new validation behavior.

✨ (event_validation.rb): add validation to prevent changing organisation and account on persisted events
✅ (events_test.rb): add test for organisation_id and account_id immutability on event update

♻️ Simplify event feedback partial structure and consolidate nested conditionals

The nested if blocks made the partial harder to read and maintain. By flattening the structure and using safer navigation (&.), the template is more concise and avoids potential nil reference issues when public_answers is absent.

🐛 Normalize hash carousel_ids to prevent CGI.escape TypeError

Fixes DANDELION-30

🐛 (pmail_mailgun.rb): return nil when opened_total is zero to prevent invalid rate calculations

✨ Enable analytics for free gift emails sent via Mailer

🔨 (local_groups_test.rb): wrap test method calls in parentheses

🐛 Preserve local group polygons on failed validation