[vitormattos]

Context

After merging #1, the automatic Dependabot security-update run #43740390386 failed because its dependency graph could not resolve patched transitive versions of minimatch and qs:

• @nextcloud/vue / WebDAV, ESLint and Stryker pulled in minimatch 9/10, whereas the advisory requires at least 11.0.1.
• Stryker uses typed-rest-client@2.3.1, which pins qs@6.15.1, affected by security advisories.
• The existing NPM audit workflow ran npm run audit, which previously ignored moderate-severity issues.

Changes

• Add narrow npm overrides for minimatch@^11.0.1 and qs@^6.16.1 and regenerate package-lock.json with Node 24 / npm 11. The resolved versions are minimatch@11.0.8 and qs@6.17.1.
• Make npm run audit enforce the moderate severity threshold, automatically tightening the existing NPM audit workflow without disabling any check.
• Remove the "Development preview" disclaimer from the product README, rewrite long-dash prose, and point fundraising at LibreSign.
• Add .github/FUNDING.yml with github: libresign.
• Replace long-dash punctuation in UI text and keep the Brazilian Portuguese catalog and source keys consistent. The tracked text files contain no remaining Unicode em/en dashes.

Repository About metadata is not a versioned file. It has already been updated directly: website https://librecode.coop/ and relevant Nextcloud / communications topics.

Validation

Validated in an isolated worktree using Node 24.22.3 and npm 11.19.1:

• npm ci --include=dev --include=optional: success
• npm ls minimatch qs: patched versions throughout the dependency tree
• npm run audit: 0 vulnerabilities, including moderate severity
• npm run lint, npm run lint:styles, npm run ts:check: pass
• npm run test:unit: 114 tests pass
• npm run test:package: 4 tests pass
• npm run package:app: pass
• npm run test:mutation: 93.02% score (above the 85% threshold)
• git diff --check: pass

Review considerations

The transitive minimatch override crosses a major version boundary for some upstream libraries. The existing unit/build/mutation checks passed, but the PR's browser/integration matrix must also pass before merging. Revisit and remove the overrides when upstream dependency ranges natively accept fixed versions. No merge is requested in this PR.