feat: Phases 4-7 — Full Feature Expansion (26 features)

Phase 4 — New Widget Types:
- Clock/Weather, System Stats, RSS/Feed, Calendar, Markdown,
  Metric/Counter, Link Group, Camera/Stream widgets
- Backend services with caching for each data source
- Full creation form with dynamic config fields per type

Phase 5 — Visual & Styling Enhancements:
- Glassmorphism card style (solid/glass/outline)
- Board-level themes with per-board hue/saturation
- Animated SVG status rings replacing static dots
- Card size options (compact/medium/large)
- Custom CSS injection (admin + per-board, sanitized)
- Wallpaper backgrounds with blur/overlay/parallax

Phase 6 — Functional Features:
- Favorites bar with drag-and-drop reordering
- Recent apps tracking with privacy toggle
- Uptime dashboard page (/status, guest-accessible)
- Notifications system (Discord/Slack/Telegram/HTTP webhooks)
- App tags with filtering in board view
- Multi-URL app cards with expandable sub-links
- Personal API tokens with scoped permissions
- Audit log with retention and admin viewer

Phase 7 — Quality of Life:
- Onboarding wizard (5-step first-launch setup)
- App URL health preview with favicon/title detection
- Board templates (4 built-in + custom import/export)
- Keyboard shortcut overlay (j/k nav, 1-9 boards, ? help)

212 files changed, 15641 insertions, 980 deletions.
Build, lint, type check, and 222 tests all pass.

src/lib/components/layout/CustomCssInjector.svelte

@@ -0,0 +1,47 @@
+<script lang="ts">
+	interface Props {
+		css: string;
+	}
+
+	let { css }: Props = $props();
+
+	/**
+	 * Sanitize CSS to prevent XSS vectors while keeping valid styling rules.
+	 * All custom CSS is wrapped in .custom-css-scope to prevent breaking critical UI.
+	 */
+	const sanitizedCss = $derived.by(() => {
+		if (!css) return '';
+
+		let cleaned = css;
+
+		// Remove any HTML tags (including <script>)
+		cleaned = cleaned.replace(/<\/?[^>]+(>|$)/g, '');
+
+		// Remove javascript: URLs
+		cleaned = cleaned.replace(/javascript\s*:/gi, '');
+
+		// Remove expression() calls
+		cleaned = cleaned.replace(/expression\s*\(/gi, '');
+
+		// Remove url() with javascript:
+		cleaned = cleaned.replace(/url\s*\(\s*['"]?\s*javascript:/gi, 'url(');
+
+		// Remove @import rules
+		cleaned = cleaned.replace(/@import\s+[^;]+;?/gi, '');
+
+		// Remove behavior: (IE XSS)
+		cleaned = cleaned.replace(/behavior\s*:/gi, '');
+
+		// Remove -moz-binding (Firefox XSS)
+		cleaned = cleaned.replace(/-moz-binding\s*:/gi, '');
+
+		return cleaned;
+	});
+</script>
+
+{#if sanitizedCss}
+	<div class="custom-css-scope contents" aria-hidden="true">
+		<!-- eslint-disable-next-line svelte/no-at-html-tags -- CSS is sanitized -->
+		{@html `<style>${sanitizedCss}</style>`}
+	</div>
+{/if}