- Add Content-Security-Policy and Permissions-Policy headers to nginx config
- Add same headers to next.config.mjs for dev/preview mode
- Add Referrer-Policy to next.config.mjs (was only in nginx)
- Generate production JWT/CMS secrets via openssl rand -base64 64
- Update README mark production env/security header task as complete
- Remove redundant `trackConversion('contact_form_submission')` in contact-content-v3.tsx
and rely on `trackContactForm(..., true)` to avoid double-counting conversions in GA4
- Update contact-content-v3.test.tsx assertions to match single analytics call
- Add Logo + company name + NOVALON to homepage HeroSection in home-content-v14.tsx
- Update homepage visual regression baselines across desktop/tablet/mobile
- Record progress in README.md
- Fix list-to-detail navigation on product/service/solution/case pages
- Fix soft 404 on service detail by removing (marketing)/loading.tsx and using force-dynamic
- Fix contact form submission feedback and news placeholder image handling
- Unify SSR/client authentication state in auth.ts
- Add "新闻动态" to main navigation
- Fix Playwright storageState path and Firefox footer link flakiness
- Add E2E coverage for nav dropdown, cases filter and auth token parsing
- Update visual regression baselines (desktop/tablet/mobile, chromium/webkit/firefox)
- Update README, lessons-learned and add REGRESSION_REPORT_2026-07-27.md
- Ignore .lighthouseci/ and heading-hierarchy-report.json