v1.0.2

- Fix CI registry login (unauthorized): use dedicated REGISTRY_TOKEN secret
  instead of GITHUB_TOKEN, fail fast with a clear error if it's unset.
- Pause ticket work-timer while a ticket is closed (won't auto-start on open
  or manual resume; stops on close via status change, quick action, API, or
  merge).
- Reject empty/blank login submissions client- and server-side instead of
  passing them straight to the auth provider.
- Closing a ticket now sends only the "ticket closed" notification instead
  of also sending a duplicate "status changed" one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to this project are documented in this file. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.0.2] - 2026-07-22
+
+- Fixed `.gitea/workflows/build.yml`: registry login was failing with
+  `unauthorized` because Gitea's auto-injected `secrets.GITHUB_TOKEN` isn't
+  granted push access to its own container registry on this instance. Now
+  uses a dedicated `REGISTRY_TOKEN` secret (a Gitea access token with
+  `write:package`/`read:package` scope), and the workflow fails fast with a
+  clear `::error::` message before attempting login if that secret isn't
+  configured, instead of surfacing Docker's opaque `unauthorized` error.
+- Fixed: opening or manually resuming a **closed** ticket no longer starts its
+  work timer, and closing a ticket (via the status dropdown, a reply "quick
+  action" transition, the REST API, or merge) now checkpoints and stops any
+  running timer. Time tracking only ever accrues while a ticket is open.
+- Fixed: the login form accepted an empty username/password, submitting them
+  straight to the auth provider. The form fields are now `required` (blocks
+  submission client-side) and `Login::submit()` also rejects blank/
+  whitespace-only credentials server-side before attempting authentication,
+  showing "Podaj nazwę użytkownika i hasło." instead.
+- Fixed: closing a ticket sent two separate notification e-mails
+  (`status_changed` and `ticket_closed`) for the same event. Closing now only
+  fires `ticket_closed`; every other status transition still fires
+  `status_changed` as before.
+
 ## [1.0.1] - 2026-07-22
 
 Documentation and deployment/CI overhaul — no application behavior changes.