v0.19.4: bump version to 0.19.4 in package.json and login screen

DEVELOPMENT_LOG.md

@@ -603,3 +603,26 @@ The `handleLegacyDatabase()` function in `db/database.js` checks for a database
 This ensures backward compatibility with existing deployments while preventing duplicate migrations.
 
 ---
+
+---
+
+## v0.19.4 — Session Token Expiry Cleanup
+
+**Date:** 2026-05-09
+**Status:** COMPLETED
+
+### Agents
+- **Neo** — Implemented cleanupExpiredSessions(), v0.43 migration, periodic purge, per-user login cleanup (19m)
+- **Bishop** — Verified all tests pass: Docker build, migration, startup logs, login, interval (3m 5s)
+- **Hudson** — Security audit: 5 PASS, 1 FAIL (SESSION_CLEANUP_INTERVAL_MS validation — fixed by Ripley)
+- **Ripley** — Fixed Hudson finding (interval validation), committed v0.19.4, pushed, deployed
+
+### Files Modified
+- `db/database.js` — cleanupExpiredSessions(), v0.43 migration, COLUMN_WHITELIST
+- `server.js` — Startup cleanup, periodic interval, input validation for SESSION_CLEANUP_INTERVAL_MS
+- `services/authService.js` — Per-user expired session cleanup on login and createSession
+- `docs/Engineering_Reference_Manual.md` — Session cleanup documentation
+
+### Commits
+- `399882f` — v0.19.4: session token expiry cleanup
+- `3a1d613` — docs: v0.19.4 changelog, remove completed item from FUTURE.md

client/lib/version.js

@@ -1,12 +1,14 @@
-export const APP_VERSION = '0.19.2';
+export const APP_VERSION = '0.19.4';
 export const APP_NAME    = 'BillTracker';
 
 export const RELEASE_NOTES = {
-  version: '0.19.2',
+  version: '0.19.4',
   date: '2026-05-09',
   highlights: [
     { icon: '🛡️', title: 'Legacy database migration fix', desc: 'Users upgrading from older versions can now log in.' },
     { icon: '🔒', title: 'Security hardening', desc: 'Path traversal protection, content redaction, error sanitization.' },
     { icon: '🪟', title: 'React Error Boundaries', desc: 'App no longer crashes to white screen on errors.' },
+    { icon: '🧹', title: 'Session token cleanup', desc: 'Expired sessions auto-purged on startup, daily, and on login.' },
+    { icon: '🔑', title: 'Admin password reset', desc: 'INIT_ADMIN_PASS now resets existing admin passwords on legacy DBs.' },
   ],
-};
+};

package.json

@@ -1,6 +1,6 @@
 {
   "name": "bill-tracker",
-  "version": "0.19.2",
+  "version": "0.19.4",
   "description": "Monthly bill tracking system",
   "main": "server.js",
   "scripts": {