Windows installer: payload hash-locking, SBOM, client-IP handling, operator docs

scripts/check-naming-and-style.sh

@@ -9,7 +9,8 @@
 #   4. No snake_case API params in frontend that should match DB column names
 #
 # Exits non-zero if any violation found.
-# Skips: venv/, node_modules/, __pycache__/, frontend/dist/, migrations/versions/
+# Skips: venv/, node_modules/, __pycache__/, frontend/dist/, migrations/versions/,
+#        deploy/windows/installer/bundle/ (installer build output)
 
 set -e
 
@@ -23,6 +24,12 @@ EXCLUDES=(
     --exclude-dir=node_modules
     --exclude-dir=__pycache__
     --exclude-dir=dist
+    # The installer's build output: a staged copy of the whole application plus
+    # a second SPA build under dist-subpath, which --exclude-dir=dist does not
+    # match. Linting it means linting vendored minified JS and failing on
+    # characters nobody in this repository wrote.
+    --exclude-dir=bundle
+    --exclude-dir=dist-subpath
     --exclude-dir=.git
     --exclude-dir=versions
     --exclude-dir=staticdocs
@@ -46,8 +53,12 @@ INCLUDES_ALL=(
     --include='*.yml'
 )
 
+# INCLUDES_ALL, not INCLUDES_CODE: the check only ever covered .py/.vue/.js/.ts,
+# so documentation was free to accumulate em-dashes, arrows and smart quotes -
+# and did, including in files this repo's own convention forbids them in.
+# Markdown, JSON and YAML are now covered too.
 echo "==> Checking for non-ASCII characters..."
-NON_ASCII=$(grep -rPn '[^\x00-\x7F]' "${EXCLUDES[@]}" "${INCLUDES_CODE[@]}" . 2>/dev/null || true)
+NON_ASCII=$(grep -rPn '[^\x00-\x7F]' "${EXCLUDES[@]}" "${INCLUDES_ALL[@]}" . 2>/dev/null || true)
 if [ -n "$NON_ASCII" ]; then
     echo "FAIL: non-ASCII characters found (em-dashes, smart quotes, arrows, emojis):"
     echo "$NON_ASCII"