Update dependency @larvit/log to v2.4.0

Release-Bump: minor

package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "plainpages",
       "dependencies": {
-        "@larvit/log": "2.3.0",
+        "@larvit/log": "2.4.0",
         "ejs": "6.0.1",
         "lucide-static": "1.59.0",
         "postgres": "3.4.9"
@@ -21,9 +21,9 @@
       }
     },
     "node_modules/@larvit/log": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@larvit/log/-/log-2.3.0.tgz",
-      "integrity": "sha512-gLRMDWrFnoMGdAr9NXMXRKOUeceU6Qd/CW0c6qDO+DLFT1xWrqO2ubsHyPqPzlZHVUO3w3Bk7kOWo6C2Ykn4ZQ==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@larvit/log/-/log-2.4.0.tgz",
+      "integrity": "sha512-0BA1S0eSzQMOP527Vy2DL9Zb68TiCgyDACr0gDiI2b/1zfY6Axq9XhR/ZJnF9URIAhQwFPYs3W6lh/T9K8vqgQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18"

package.json

@@ -16,7 +16,7 @@
     "test": "node --test \"src/**/*.test.ts\" \"plugins/**/*.test.ts\" \"examples/**/*.test.ts\" \"registry-cleanup/**/*.test.ts\" \"release-tooling/**/*.test.ts\""
   },
   "dependencies": {
-    "@larvit/log": "2.3.0",
+    "@larvit/log": "2.4.0",
     "ejs": "6.0.1",
     "lucide-static": "1.59.0",
     "postgres": "3.4.9"

todo.md

@@ -2,6 +2,7 @@
 
 ## Unfinnished work
 
+- [ ] **Publish every release to Docker Hub, and give the Hub page its short description.** Today Hub's newest tag is 0.4.0 (2026-09-10), while git has v0.4.1–v0.4.12, and the overview still says 0.4.0. No `release.yml` run exists for the tags auto-release pushes as `renovate-bot`, so neither the images nor the overview reach Hub; find out why Gitea doesn't fire `push: tags` for them, fix it, and backfill the missing tags. The short description is empty. fejkdata already did this (`../fejkdata`, commits `51d924a` and `34c8234`), and two parts port directly: a `dockerhub/description.txt`-style one-liner, which here can ride the existing PATCH as its `description` field; and a unit test that the description opens a README sentence and every command the overview shows appears in the README. fejkdata also syncs the page on any push to `main` that changes it, with its own Read/Write/Delete token in an environment only `main` may use, so the image-push token needs no Delete scope. Decide whether that fits here, where `{{VERSION}}` must render a released tag.
 - [ ] Rename the plugin "admin" to something less generic, like "auth-admin" or "users-groups-admin".
 - [ ] Guard the group paths against self-lockout, or accept them explicitly. The self-revoke guard covers only your own *direct* grants on the Users screen; unticking a permission on a group you belong to, removing yourself from that group, or deleting it can all still strip your own effective access with no warning. Recorded in AGENTS.md as a known gap — the robust fix is a "last effective holder" check, which needs a reverse Keto query.
 - [ ] The permission picker has no concurrency baseline, so two operators editing the same user/group silently discard each other's change. Sketch: post the rendered set as a hidden baseline; if it no longer matches Keto, re-render with "this changed while you had the page open" rather than applying.