pip: cryptography 48.0.1->49.0.0 (supersedes the advisory fix, #371),
idna 3.18 (#370), anthropic 0.109.1 (#372), huggingface-hub 1.19.0 (#373),
pytest 9.1.0 (#374). npm: @typescript-eslint/parser + typescript-eslint
8.61.0 (#369,#365), @vitejs/plugin-react 6.0.2 (#367), @tailwindcss/vite
4.3.1 (#366), lucide-react 1.18.0 (#368). Full suite + tsc + build green.

…#380)

* fix: bump cryptography to 48.0.1 (GHSA-537c-gmf6-5ccf)

pip-audit flagged cryptography 48.0.0 against a newly disclosed advisory
GHSA-537c-gmf6-5ccf (fix 48.0.1), failing CI on every branch. Patch-level
dependency bump with regenerated hashes; no app code change. Releases as
2.8.12.

* chore(deps): bump all open dependabot deps for 2.8.12

pip: cryptography 48.0.1->49.0.0 (supersedes the advisory fix, #371),
idna 3.18 (#370), anthropic 0.109.1 (#372), huggingface-hub 1.19.0 (#373),
pytest 9.1.0 (#374). npm: @typescript-eslint/parser + typescript-eslint
8.61.0 (#369,#365), @vitejs/plugin-react 6.0.2 (#367), @tailwindcss/vite
4.3.1 (#366), lucide-react 1.18.0 (#368). Full suite + tsc + build green.

* feat: per-feed display title override (#375)

Adds a refresh-safe title_override column. The rename actually replaces the
channel title in the SERVED RSS (both <title> and <image><title> via
modify_feed), so podcast apps show the custom name and a processed feed is
distinguishable from the source. RSS refresh keeps updating the source
title but never touches the override. API: titleOverride on get/list/update
feed with a length-capped validator; the clobbered raw-title PATCH path is
removed. New unit + endpoint tests.

* feat(ui): editable feed title on the detail page (#375)

Inline-edit affordance in the FeedDetail header: hover pencil opens an
input, Enter/Save persists, Esc/Cancel aborts; a Custom badge marks an
override and blank clears it back to the source title. Feeds list and
cards show the effective (override || source) title so the custom name
appears in the library.

* docs: 2.8.12 changelog (title override + dependency sweep)

* simplify: share feedDisplayTitle helper across feed-title render sites

Centralizes override||title in one helper and applies it to the feeds
list, cards, detail header, and the Stats/History podcast filters (the
last two still showed the source title). Minor: helper-text && over a
dead-arm ternary; fix a stray indentation in the update_feed response.

* review: regenerate served feed on rename + sanitize the title override

Two code-review fixes: (1) a titleOverride-only PATCH now force-regenerates
the cached RSS (it was only triggered by max_episodes/onlyExpose), so the
renamed <title> actually reaches subscribers instead of waiting for the next
upstream change; (2) strip XML-forbidden control chars and collapse interior
newlines in the validator -- an interior control char made the served feed
not-well-formed and every app would reject it. Adds regen + sanitization +
well-formed-XML tests.

* fix(deps): bump hf-xet to 1.5.1 for huggingface-hub 1.19.0 compatibility

huggingface-hub 1.19.0 requires hf-xet>=1.5.1,<2.0.0; the transitive pin
was still at 1.4.3, which made a fresh --require-hashes resolve fail in CI
(pip-audit and Python tests).

* release 2.8.13: feed detail UI cleanup

- Always-visible title edit pencil (was hover-only, untappable on touch)
- Tags section collapsed by default
- Per-feed controls moved into a collapsed 'Feed settings' section,
  extracted to FeedSettingsPanel.tsx to match the other feed panels