Interchange formats. Statements now import from OFX/QFX, CAMT.053, QIF and Excel
workbooks, so most banks are read from a published format instead of a CSV they can
reshape without notice. A statement whose currency is pegged to the account's is
offered the conversion, at the legal parity. Two removals make this a major: the
euro American Express CSV importer is gone — download the OFX behind Amex's "Quicken"
button instead — and with it the `american-express-eur` slug, which now answers 404;
`docker-compose.yml` is replaced by `compose.yml` (development database) and
`compose-demo.yml` (full demo stack). Failed logins are throttled. No migration: the
database is unchanged since 9.

📝 Add repeatable security-testing checklist
💄 Keep the last rows clear of the floating FABs
💄 Brighten the tab icon so Safari stops plating it white
♻️ Rename CsvImporter to StatementImporter
✨ Import OFX and QFX statements
✨ Import CAMT.053 statements
✨ Import QIF registers
🚑 Stop the QIF importer's name pointing at OFX files
♻️ Organise the importer package by format and bank
📝 Record that package segments are snake_case
🔥 Drop the euro American Express importer
🐛 Convert Amex euros by the legal peg, not a rounded rate
✨ Offer the conversion when a statement's currency is pegged
💄 Colour the currency step as a question, not a problem
🐛 Let the import past the currency step
✨ Import Excel workbooks (.xlsx)
📝 Simulate eight personas, and walk two of them
📝 Refresh the project guidelines
📝 update .gitignore
🚚 Split the demo stack out of the development compose
👷 Move :latest to the newest release on every tag
⚡️ Cut the Docker build context from 4.3 GB to 3.7 MB
📝 Organise self-hosting around the database, not the container
📝 Write the personas against intent, not the repository's layout
📝 Refresh the project guidelines for the new layout
🔒️ Throttle failed logins instead of letting them run free