…doleStudio#1016)

* feat(web): add WhatsApp-style formatting for URL-backed phone messages

- Render *bold*, _italic_, ~strikethrough~, `code`/```code block``` and
  "> " quoted lines on the thread page, only for messages whose owner
  phone uses an HTTP notification URL instead of an FCM token.
- Auto-link raw URLs as clickable anchors, protected from markdown
  replacements via placeholder tokens.
- Require markers to be bounded by whitespace, punctuation, or the
  start/end of the string, matching WhatsApp's own formatting rules.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a795297d-527c-4f30-a35a-ab379f2d50a8

* fix(web): simplify URL notification token detection to https:// prefix

Address review comment: use token.trim().toLowerCase().startsWith('https://') instead of checking multiple schemes/substrings.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a795297d-527c-4f30-a35a-ab379f2d50a8

* fix(web): address code review on WhatsApp formatter

- Preserve balanced parentheses in linkified URLs (e.g.
  https://example.com/page_(v2)) instead of always stripping the
  closing paren.
- Support multiline fenced code blocks (```...```) where the content
  starts on the line after the opening fence.
- Strip trailing formatting markers (*_~`) from a matched URL so
  "*https://example.com*" bolds the link instead of leaving an
  unmatched opening marker.
- Protect already-rendered inline/fenced code from the bold/italic/
  strikethrough passes so markers inside code render literally.
- Use a per-call random nonce for placeholder tokens so literal
  message text can never collide with a placeholder and silently
  disappear or get replaced.
- Require the quote prefix to be exactly "> " (space required) so a
  bare ">" with no following space is left untouched.
- Add an automated test suite (app/utils/whatsapp-format.test.ts) run
  via Node's built-in test runner (`pnpm test`), covering boundaries,
  quotes, code blocks, links, and escaping/placeholder safety.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a795297d-527c-4f30-a35a-ab379f2d50a8

* fix(web): only strip URL trailing marker when it pairs with an opener

Trailing *_~` characters were stripped from every linkified URL, even
when they're legitimate URL path characters (e.g.
https://example.com/file_name_ linked to /file_name instead of
/file_name_). Now a trailing marker is only dropped when the same
character immediately precedes the URL, confirming it's an actual
wrapping delimiter (e.g. *https://example.com*) rather than part of
the URL itself. Sentence punctuation and balanced-parenthesis handling
are unchanged.

Also fixes a typo ("oe" -> "or") in a test case.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a795297d-527c-4f30-a35a-ab379f2d50a8

* fix(web): avoid CodeQL incomplete-URL-substring-sanitization alert

Replace .includes() URL substring checks in a test assertion with
regex matches against the rendered href attribute. CodeQL flags raw
.includes(url) checks as a potential (flawed) security validation
pattern; this was only a test assertion on rendered output, but the
rewrite is also a more precise check (it verifies the URL became an
anchor's href rather than just appearing anywhere in the string).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a795297d-527c-4f30-a35a-ab379f2d50a8

* fix(tests): raise sent/delivered poll timeout in rate-limit test to 30s

TestSendSMS_RateLimit failed intermittently in CI: fireEvent dispatches
the SENT/DELIVERED cloud event through an async loopback HTTP push
(emulatorPushQueue), and the 15s poll window was too tight under CI
load, failing right at the boundary. Other tests already poll the
'delivered' status with a 30s timeout; align this test with that
margin for both 'sent' and 'delivered' polls.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a795297d-527c-4f30-a35a-ab379f2d50a8

Bumps [devalue](https://github.com/sveltejs/devalue) from 5.9.2 to 5.9.4.
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.9.2...v5.9.4)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 5.9.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3362f283-a915-49b9-ae89-d16e3c7ecb2a

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3362f283-a915-49b9-ae89-d16e3c7ecb2a