Davy7/28/2026, 9:57:58 PM

* fix(standards): apply product quality baselines across the codebase

Audit the codebase against the six standards profiles introduced in #295
and apply fixes for the violations found.

Interaction and accessibility (WCAG 2.2 AA, WAI-ARIA APG):
- ContextMenu: add role=menu, role=menuitem, arrow/Home/End/Enter
  navigation, type-ahead, submenu ARIA, focus return to trigger.
- MonitorPicker: add role=listbox, role=option, aria-selected, arrow
  navigation, focus return to trigger.
- QueuePanel: change drag handle from div to button; add 24x24 target
  size to move buttons.
- SongListItem, SongPropertiesDialog, RotationControls, VolumeSliders,
  QueueButton: increase interactive target sizes to 24x24 CSS px min.
- RemoteReconnectIndicator, UpdateBanner: add aria-live regions for
  status and progress announcements.

Security, privacy, and release:
- Add SECURITY.md with private reporting channel, CVSS severity
  classification, response SLA, and 90-day coordinated disclosure.
- Add .github/dependency-review.yml for NIST SSDF dependency policy.

Lifecycle, quality, and testing:
- Add ADR 0015 (lyrics multi-source fallback chain) and ADR 0016
  (local source separation via ONNX Runtime).
- Add user-outcome and acceptance-criteria fields to the feature
  request issue template and the PR template.

Interfaces and compatibility:
- Document ~30 undocumented IPC commands and 8 events across
  library, separation, lyrics, settings, model-bootstrap, and
  playback contract files.

Models, media, and operations:
- Add evaluation_fixture, capability_limit, and known_user_effect
  fields to the model catalog schema and populate them for all
  shipped models with values derived from the separation code.

* test(standards): cover ContextMenu and MonitorPicker keyboard ARIA paths

Add jsdom tests for the WAI-ARIA keyboard navigation and ARIA semantics
introduced in the standards audit fix. Covers role=menu/menuitem,
role=listbox/option, arrow/Home/End/Enter/Space/Escape navigation,
type-ahead, submenu open/close, mouse enter handlers, and aria-live
focus management for both widgets.

Patch coverage for the changed lines now meets the 80% Codecov target.

* test(standards): cover remaining ContextMenu and MonitorPicker ARIA paths

Add tests for empty menu rendering, ArrowRight on leaf items, submenu
checkbox clicks, submenu mouseEnter focus, and document-level Escape
in MonitorPicker. Removes the unused cleanup helper.

Patch coverage now 98.7% (was 93.75%). The 2 remaining uncovered lines
are the scheduleHide setTimeout callback and onMouseLeave handler,
which cannot be triggered via jsdom synthetic events.

Parent6bffb92