Merge remote-tracking branch 'upstream/pull/5386'

Merge remote-tracking branch 'upstream/pull/5384'

Merge remote-tracking branch 'upstream/pull/5383'

Merge remote-tracking branch 'upstream/pull/5382'

Protect against malicious branch names

Allow specifying extra layer options in layers.yml

Remove logger.debug from relation update action

Let header username expand to screen width in small nav mode

Don't interpolate type in issue title

Merge remote-tracking branch 'upstream/pull/5377'

Merge remote-tracking branch 'upstream/pull/5381'

Merge remote-tracking branch 'upstream/pull/5380'

Localisation updates from https://translatewiki.net.

Don't show types twice in issue type select

Use translated model names in issue type select

Merge remote-tracking branch 'upstream/pull/5374'

Merge remote-tracking branch 'upstream/pull/5378'

Merge remote-tracking branch 'upstream/pull/5376'

Include data: when using allow_thirdparty_images CSP

Truncate if necessary and set dir=auto for note usernames

Truncate usernames in trace navigation tabs

Use relation icon instead of word in containing relations

Merge remote-tracking branch 'upstream/pull/5372'

Merge remote-tracking branch 'upstream/pull/5371'

Update bundle

Truncate if necessary and set dir=auto for message usernames

Truncate if necessary and set dir=auto for changeset usernames

Merge remote-tracking branch 'upstream/pull/5366'

Merge remote-tracking branch 'upstream/pull/5365'

Merge remote-tracking branch 'upstream/pull/5364'

Localisation updates from https://translatewiki.net.

Truncate usernames in block navigation tabs

Set dir=auto on usernames in block lists

Set dir=auto on username in header

Merge remote-tracking branch 'upstream/pull/5360'

Bump eslint from 9.15.0 to 9.16.0

Bumps [eslint](https://github.com/eslint/eslint) from 9.15.0 to 9.16.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v9.15.0...v9.16.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Don't send comment text when reopening a note

Fixes #5359.

Localisation updates from https://translatewiki.net.

Move html_safe declaration for user_mailer from layout to helper

This allows us to enable output safety checks for all code within
erb files.

`rubocop --auto-gen-config` ignores code within the erb files, so
it is easier to maintain an exclusion on the helper than inside
the layout.

Merge remote-tracking branch 'upstream/pull/5357'

Resolve erb_lint deprecations

They have standardized on underscores. See
https://github.com/Shopify/erb_lint/pull/360

Merge pull request #4316 from AntonKhorev/block-reason-max-length

Set max length of block reason

Update bundle

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/5353'

Add default browse icons for nodes, ways, relations

Merge remote-tracking branch 'upstream/pull/5349'

Move layer definitions to yml

Merge remote-tracking branch 'upstream/pull/5346'

Move map layer ids/codes/keys to layer definition data

Add subscribe/unsubscribe buttons to note pages

Merge remote-tracking branch 'upstream/pull/5348'

Collect map layer credits into a data structure

Localisation updates from https://translatewiki.net.

Merge pull request #5314 from AntonKhorev/note-subscriptions-api

Note subscriptions API

Add destroy note subscription api endpoint

Add create note subscription api endpoint

Update bundle

Merge remote-tracking branch 'upstream/pull/5341'

Bump qs from 6.13.0 to 6.13.1

Bumps [qs](https://github.com/ljharb/qs) from 6.13.0 to 6.13.1.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/qs/compare/v6.13.0...v6.13.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge branch 'pull/5297'

Add status filter to user's note page

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/5335'

Merge remote-tracking branch 'upstream/pull/5334'

Merge branch 'pull/5338'

Enable dark mode attribution font color

Increases the specificity of the dark mode attribution selector. This makes it overwrite Leaflet's default link selector.

Bump eslint from 9.14.0 to 9.15.0

Bumps [eslint](https://github.com/eslint/eslint) from 9.14.0 to 9.15.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v9.14.0...v9.15.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump @eslint/plugin-kit from 0.2.0 to 0.2.3

Bumps [@eslint/plugin-kit](https://github.com/eslint/rewrite) from 0.2.0 to 0.2.3.
- [Release notes](https://github.com/eslint/rewrite/releases)
- [Changelog](https://github.com/eslint/rewrite/blob/main/release-please-config.json)
- [Commits](https://github.com/eslint/rewrite/compare/core-v0.2.0...plugin-kit-v0.2.3)

---
updated-dependencies:
- dependency-name: "@eslint/plugin-kit"
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #5333 from AntonKhorev/auth-buttons-same-as-preferred

Style small auth buttons similarly to preferred auth buttons

Merge pull request #5331 from AntonKhorev/trace-badges-text-bg

Set colors for trace visibility badges using .text-bg-*

Merge pull request #5332 from AntonKhorev/layer-preview-backgrounds

Set background for layer buttons to secondary body color

Style small auth buttons similarly to preferred auth buttons

Set background for layer buttons to secondary body color

Set colors for trace visibility badges using .text-bg-*

Merge pull request #5330 from AntonKhorev/apply-tile-filter-once

Apply dimming filter to tiles directly

Apply dimming filter to tiles directly

Merge remote-tracking branch 'upstream/pull/5320'

Localisation updates from https://translatewiki.net.

Remove jQuery.timers plugin

Merge pull request #4761 from AntonKhorev:dark-mode-with-close-button

Enable dark theme if user prefers dark color scheme - no javascript version

Merge pull request #5151 from AntonKhorev/no-history-and-export-buttons

Move History and Export buttons to secondary nav

Merge pull request #5293 from AntonKhorev/user-roles-resourceful-routes

Use resourceful routes for granting/revoking user roles

Merge remote-tracking branch 'upstream/pull/5319'

Merge remote-tracking branch 'upstream/pull/5318'

Merge pull request #5158 from tomhughes/vagrant-debian

Switch vagrant to use Debian 12

Add note on assigning issues

New users are encouraged by Github to read the CONTRIBUTING file,
so that's where it's worth putting it. The explanation of why can
be put elsewhere.

Merge remote-tracking branch 'upstream/pull/5316'

Merge remote-tracking branch 'upstream/pull/5315'

Merge remote-tracking branch 'upstream/pull/5312'

Switch vagrant to use Debian 12

Merge pull request #5295 from tomhughes/danger-branches

Create base and head branches before running danger

Merge pull request #5303 from tomhughes/remember-me

Make the "remember me" option work as intended

Remove unused timer from new note js controller

Make the "remember me" option work as intended

Show spinner using delayed css animation in sidebar loader

Add yaml syntax highlighting to code blocks

Show spinner using delayed css animation in richtext preview

Add missing headers to docs

Use fenced code blocks

For consistency with other documentation