Merge remote-tracking branch 'origin/main' into feat/journal-post-form

.gitignore

@@ -6,5 +6,6 @@
 /pages/01.trips/italy-2026-demo/
 /pages/02.post/*ui-test*/
 /config/plugins/git-sync.yaml
+/config/plugins/api-private.php
 /config/security.yaml
 /themes/intotheeast/node_modules/

config/plugins/api.yaml

@@ -1,4 +1,60 @@
-popularity:
-  salt: 671ae9ab4f792c7dc860dbe8be288f2fdebdb3b4615f3c0f43211ecb95aaeeb3
+enabled: true
+route: /api
+version_prefix: v1
 auth:
-  jwt_secret: 61a84160bdd430768c82c4fe153e151a7a6f68f993c3779a5f36d32ee9293653
+  api_keys_enabled: true
+  jwt_enabled: true
+  jwt_algorithm: HS256
+  jwt_expiry: 3600
+  jwt_refresh_expiry: 604800
+  session_enabled: true
+cors:
+  enabled: true
+  origins: {  }
+  methods:
+    - GET
+    - POST
+    - PATCH
+    - DELETE
+    - OPTIONS
+  headers:
+    - Content-Type
+    - Authorization
+    - X-API-Key
+    - X-API-Token
+    - X-Grav-Environment
+    - If-Match
+    - If-None-Match
+  expose_headers:
+    - ETag
+    - X-Invalidates
+    - X-RateLimit-Limit
+    - X-RateLimit-Remaining
+    - X-RateLimit-Reset
+  max_age: 86400
+  credentials: false
+rate_limit:
+  enabled: true
+  requests: 120
+  window: 60
+  storage: file
+flex_backend:
+  pages: true
+  accounts: true
+pagination:
+  default_per_page: 20
+  max_per_page: 1000
+invitations:
+  expiration: 604800
+popularity:
+  enabled: true
+  exclude_admin: true
+  exclude_ips: {  }
+  history:
+    daily: 30
+    monthly: 12
+    visitors: 20
+  ignore:
+    - '/test*'
+    - /modular
+  salt: 37517ad926e4f900863af7f1b58718cdccc34f7265dedd09d33b6f820046c510

config/system.yaml

@@ -210,7 +210,7 @@ session:
   domain: null
   path: null
 gpm:
-  releases: testing
+  releases: stable
   official_gpm_only: true
 http:
   method: curl
@@ -237,7 +237,8 @@ flex:
       lifetime: 600
 strict_mode:
   yaml_compat: false
-  twig_compat: false
   blueprint_compat: false
+  twig2_compat: false
+  twig3_compat: true
 uploads_privacy:
   enabled: false