💄 (events_build): replace dashed-border block with styled well and input-group for affiliate credit percentage

🐛 Fix HTML sanitization to strip tags instead of escaping them

Replace Sanitize.fragment with Nokogiri HTML parsing to extract plain text, ensuring user content is cleaned without breaking display.

♻️ Rename parameter organisation → cohost for clarity

The method now receives a co-host object instead of a generic “organisation”, making its purpose self-documenting and avoiding confusion with the main event organiser.

🎨 (event_stats_row/_buttons.erb): re-indent inline JS for better readability

♻️ rename Event#display_image_source_for → image_source

Drops the redundant “display_” prefix and keeps the method concise while preserving the same behaviour across controllers, helpers and views.

♻️ Extract cohost/event image selection logic into display_image_source_for

Replace duplicated cohost-vs-event image picking with a single model method. This keeps controllers, helpers and views focused on presentation and eliminates three near-identical code blocks.

♻️ Extract duplicated image-source logic into Event#display_image_source_for

• DRY up three templates that repeated the same cohostship vs. event image decision
• New helper returns the actual record (Cohostship or Event) to use, letting views simply ask for its image and dimensions
• Keeps behaviour identical while shrinking templates and preventing future drift

🎨 (events.erb): remove environment-based image toggle and always show images when present

♻️ (views): remove hard-coded full_width flag and simplify image column logic

• Drop the obsolete full_width variable
• Let layout width depend only on presence of event.image
• Keep behaviour identical while trimming duplicated conditionals

🔒 (notification.rb): sanitize user-generated text in notification messages to prevent XSS

🩹 Sanitize user-supplied text fields before validation

• Introduce constant SANITIZED_FIELDS listing attributes that must be stripped of HTML tags
• Add before_validation callback sanitize_fields that removes any HTML from name, title and subject using Sanitize.fragment
• Prevents stored XSS when these fields are rendered later

🔒️ Add protected_attributes class method to payment models

Declare payment_completed as protected in Donation, Order, Payment and Ticket so it can no longer be mass-assigned via public API calls. This prevents clients from manually marking payments as completed and enforces that only internal business logic can flip the flag.

🔧 (.eslintrc.js): remove obsolete global declarations to clean up config
🗃️ (models/organisation.rb): add protected_attributes list to safeguard paid_up fields

🐛 Fix Mailgun upsell link placement in pmails view

🐛 Fix free-tier message logic to show “sending…” when mail queued

🩹 Add client-side phone validation with country-code hint

💄 Add right margin to event labels for better spacing

♻️ (searchable.rb): add fuzzy matching to text search with maxEdits=2 and prefixLength=2

♻️ (search_helper): narrow event search scope from 1 month to 1 week ago

♻️ (search_helper): simplify event deduplication logic to use uniq by name and location instead of manual earliest filtering