<type>: <subject - what changed, all changes summarized>

<what changed + why, combined naturally>

<additional context if multi-file or complex>:
- <change 1>
- <change 2>

<file tree>
├── path/to/modified.ts*   <- brief annotation
└── path/to/context.ts

feat: add auto-migrations to deploy pipeline

Migrations now run automatically on every deploy via Trellis hook.
Safe because symlink switch happens AFTER migrations succeed.

deploy/
├── hooks/build-after.yml*    <- run migrations post-deploy
├── hooks/deploy-prepare.yml
└── docs/migrations.md*       <- design rules added

fix: prevent cron ping pileup when requests take longer than interval

WordPress wp-cron.php uses ignore_user_abort(true), so PHP keeps
processing after client timeout. With 10s interval and 5s timeout,
requests piled up. Now skips ping if previous request is in flight.

app/
├── Services/CronPing.php*    <- added in-flight check
└── config/schedule.php       <- interval config lives here

feat: add Matomo configurator, 1Password secrets, and security hardening

Matomo:
- MatomoConfigurator with MaxMind GeoIP download
- Patches to remove newsletter and update nags

Secrets:
- 1Password integration via .vault_pass
- `bun secrets` command for local env vars

app/
├── Configurators/
│   └── MatomoConfigurator.php*   <- new configurator
├── Commands/SecretsCommand.php*  <- bun secrets
├── .vault_pass*                  <- 1Password integration
└── trellis/
    └── group_vars/all/vault.yml* <- encrypted secrets

chore: update aws-sdk-php to fix security advisory

composer.lock*