diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
deleted file mode 100644
index 8f1dd76..0000000
--- a/.github/workflows/build.yml
+++ /dev/null
@@ -1,186 +0,0 @@
-name: Build & Publish
-run-name: Build ${{ github.event.release.tag_name }}
-
-on:
-  release:
-    types: [created]
-
-permissions:
-  contents: write
-
-concurrency:
-  group: build-${{ github.event.release.tag_name }}
-  cancel-in-progress: false
-
-env:
-  GO_VERSION: "1.25"
-  PNPM_VERSION: "10"
-  NODE_VERSION: "22"
-  NODE_OPTIONS: "--max-old-space-size=4096"
-
-jobs:
-  build:
-    name: Build (${{ matrix.name }})
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: Linux (amd64)
-            os: ubuntu-latest
-            platform: linux/amd64
-            binary: yellowjacket
-            artifact: yellowjacket-linux-amd64
-          - name: macOS (universal)
-            os: macos-latest
-            platform: darwin/universal
-            binary: yellowjacket
-            artifact: yellowjacket-darwin-universal
-          - name: Windows (amd64)
-            os: windows-latest
-            platform: windows/amd64
-            binary: yellowjacket.exe
-            artifact: yellowjacket-windows-amd64.exe
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.release.tag_name }}
-          submodules: recursive
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-          cache-dependency-path: frontend/pnpm-lock.yaml
-
-      # ── System dependencies ──────────────────────
-      - name: Install Linux dependencies
-        if: runner.os == 'Linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libasound2-dev libgtk-3-dev libwebkit2gtk-4.1-dev
-
-      # ── Install Wails CLI ────────────────────────
-      - name: Install Wails
-        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest
-
-      # ── Build ────────────────────────────────────
-      - name: Determine version
-        id: version
-        shell: bash
-        run: |
-          VERSION="${{ github.event.release.tag_name }}"
-          VERSION="${VERSION#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Building version: $VERSION"
-
-      - name: Build (Linux)
-        if: runner.os == 'Linux'
-        working-directory: ${{ github.workspace }}
-        run: |
-          wails build \
-            --platform ${{ matrix.platform }} \
-            -o ${{ matrix.binary }} \
-            -tags webkit2_41 \
-            -ldflags "-s -w -X 'main.version=${{ steps.version.outputs.version }}' -X 'main.commit=${{ github.sha }}'"
-
-      - name: Build (macOS)
-        if: runner.os == 'macOS'
-        working-directory: ${{ github.workspace }}
-        run: |
-          wails build \
-            --platform ${{ matrix.platform }} \
-            -o ${{ matrix.binary }} \
-            -ldflags "-s -w -X 'main.version=${{ steps.version.outputs.version }}' -X 'main.commit=${{ github.sha }}'"
-
-      - name: Build (Windows)
-        if: runner.os == 'Windows'
-        working-directory: ${{ github.workspace }}
-        shell: bash
-        run: |
-          wails build \
-            --platform ${{ matrix.platform }} \
-            -o ${{ matrix.binary }} \
-            -ldflags "-s -w -X 'main.version=${{ steps.version.outputs.version }}' -X 'main.commit=${{ github.sha }}'"
-
-      # ── Fix permissions ──────────────────────────
-      - name: Set executable permission (Linux)
-        if: runner.os == 'Linux'
-        run: chmod +x build/bin/${{ matrix.binary }}
-
-      - name: Set executable permission (macOS)
-        if: runner.os == 'macOS'
-        run: chmod +x build/bin/${{ matrix.binary }}.app/Contents/MacOS/*
-
-      # ── Zip macOS .app bundle ────────────────────
-      - name: Zip macOS app
-        if: runner.os == 'macOS'
-        working-directory: ${{ github.workspace }}
-        run: |
-          ditto -c -k --keepParent build/bin/${{ matrix.binary }}.app build/bin/${{ matrix.artifact }}.app.zip
-
-      # ── Upload artifacts ─────────────────────────
-      - name: Upload artifact (Linux/Windows)
-        if: runner.os != 'macOS'
-        uses: actions/upload-artifact@v6
-        with:
-          name: ${{ matrix.artifact }}
-          path: build/bin/${{ matrix.binary }}
-
-      - name: Upload artifact (macOS)
-        if: runner.os == 'macOS'
-        uses: actions/upload-artifact@v6
-        with:
-          name: ${{ matrix.artifact }}
-          path: build/bin/${{ matrix.artifact }}.app.zip
-
-  publish:
-    name: Publish Release
-    runs-on: ubuntu-latest
-    needs: [build]
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@v7
-        with:
-          path: ${{ github.workspace }}/artifacts
-
-      - name: Prepare release assets
-        working-directory: ${{ github.workspace }}/artifacts
-        run: |
-          mkdir -p release
-          cp yellowjacket-linux-amd64/yellowjacket          release/yellowjacket-linux-amd64
-          cp yellowjacket-darwin-universal/yellowjacket-darwin-universal.app.zip release/yellowjacket-darwin-universal.app.zip
-          cp yellowjacket-windows-amd64.exe/yellowjacket.exe release/yellowjacket-windows-amd64.exe
-          echo "Release assets:"
-          ls -lh release/
-
-      - name: Upload assets to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          # The release was already created as a draft by semantic-release.
-          # This step finds it by tag and attaches binaries, then publishes.
-          draft: false
-          tag_name: ${{ github.event.release.tag_name }}
-          fail_on_unmatched_files: true
-          files: |
-            artifacts/release/yellowjacket-linux-amd64
-            artifacts/release/yellowjacket-darwin-universal.app.zip
-            artifacts/release/yellowjacket-windows-amd64.exe
-
-      - name: Upload to R2
-        uses: ryand56/r2-upload-action@v1.4
-        with:
-          r2-account-id: ${{ secrets.R2_ACCOUNT_ID }}
-          r2-access-key-id: ${{ secrets.R2_ACCESS_KEY_ID }}
-          r2-secret-access-key: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          r2-bucket: yj-binaries
-          source-dir: artifacts/release
-          destination-dir: releases/${{ github.event.release.tag_name }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index d5432e1..0000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,214 +0,0 @@
-name: CI
-run-name: CI — ${{ github.head_ref || github.ref_name }}
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  # Allow running manually for debugging.
-  workflow_dispatch:
-
-concurrency:
-  group: ci-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
-
-env:
-  GO_VERSION: "1.25"
-  PNPM_VERSION: "10"
-  NODE_OPTIONS: "--max-old-space-size=4096"
-
-jobs:
-  # ──────────────────────────────────────────────
-  # Enforce conventional commit format on PR title
-  # (squash-merge means PR title = release commit)
-  # ──────────────────────────────────────────────
-  commitlint:
-    name: Lint PR Title
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: read
-    steps:
-      - uses: amannn/action-semantic-pull-request@v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          types: |
-            feat
-            fix
-            perf
-            refactor
-            revert
-            docs
-            style
-            chore
-            ci
-            test
-            build
-
-  # ──────────────────────────────────────────────
-  # Go: lint, vet, vulnerability check
-  # ──────────────────────────────────────────────
-  go-checks:
-    name: Go Checks
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libgtk-3-dev libwebkit2gtk-4.1-dev
-
-      # The go:embed directive in main.go requires frontend/dist to exist.
-      # A stub suffices for vet/lint; the real build is verified separately.
-      - name: Create frontend dist stub
-        run: mkdir -p frontend/dist && touch frontend/dist/index.html
-
-      - name: Go mod verify
-        run: go mod verify
-
-      - name: Go vet
-        run: go vet -tags webkit2_41 ./...
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
-        with:
-          version: v2.11.4
-          args: --timeout 5m --build-tags webkit2_41
-
-      - name: govulncheck
-        uses: golang/govulncheck-action@v1
-        with:
-          go-version-input: ${{ env.GO_VERSION }}
-          go-package: ./...
-          repo-checkout: false
-
-  # ──────────────────────────────────────────────
-  # Go: run tests
-  # ──────────────────────────────────────────────
-  go-test:
-    name: Go Tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libgtk-3-dev libwebkit2gtk-4.1-dev
-
-      # The go:embed directive in main.go requires frontend/dist to exist.
-      - name: Create frontend dist stub
-        run: mkdir -p frontend/dist && touch frontend/dist/index.html
-
-      - name: Run tests
-        run: go test -tags webkit2_41 -race -count=1 -timeout 120s ./...
-
-  # ──────────────────────────────────────────────
-  # Code generation: verify generated code is fresh
-  # ──────────────────────────────────────────────
-  codegen-check:
-    name: Code Generation Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-go@v6
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libgtk-3-dev libwebkit2gtk-4.1-dev
-
-      - name: Run code generation
-        run: go generate ./...
-
-      - name: Check for uncommitted changes
-        run: |
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "::error::Generated code is out of date. Run 'make generate' and commit the changes."
-            git diff --stat
-            git diff
-            exit 1
-          fi
-          echo "Generated code is up to date."
-
-  # ──────────────────────────────────────────────
-  # Frontend: type-check
-  # ──────────────────────────────────────────────
-  frontend:
-    name: Frontend Type Check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: frontend
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: frontend/pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Type check
-        run: pnpm exec tsc --noEmit
-
-  # ──────────────────────────────────────────────
-  # Build verification: ensure it compiles
-  # (only runs on PRs; release builds are handled
-  #  by the Build & Publish workflow)
-  # ──────────────────────────────────────────────
-  build-check:
-    name: Build Check (${{ matrix.platform }})
-    if: github.event_name == 'pull_request'
-    needs: [go-checks, go-test, codegen-check, frontend]
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            os: ubuntu-latest
-            build-name: yellowjacket
-            apt-deps: libasound2-dev
-          # - platform: darwin/universal
-          #   os: macos-latest
-          #   build-name: yellowjacket
-          # - platform: windows/amd64
-          #   os: windows-latest
-          #   build-name: yellowjacket.exe
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          submodules: recursive
-
-      - name: Install system dependencies (Linux)
-        if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y ${{ matrix.apt-deps }}
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-
-      - name: Build with Wails
-        uses: dAppServer/wails-build-action@main
-        with:
-          build-name: ${{ matrix.build-name }}
-          build-platform: ${{ matrix.platform }}
-          go-version: ${{ env.GO_VERSION }}
-          package: false
-          app-working-directory: ${{ github.workspace }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index e117836..0000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,60 +0,0 @@
-name: Release
-run-name: Release — determine version
-
-on:
-  push:
-    branches: [main]
-
-# Only one release at a time.
-concurrency:
-  group: release
-  cancel-in-progress: false
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  semantic-release:
-    name: Semantic Release
-    runs-on: ubuntu-latest
-    steps:
-      # persist-credentials: false prevents actions/checkout from setting up
-      # the credential helper with GITHUB_TOKEN. We configure git auth manually
-      # with the PAT so that tag pushes trigger downstream workflows.
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Configure git credentials
-        run: |
-          git config --global credential.helper store
-          echo "https://x-access-token:${{ secrets.RELEASE_TOKEN }}@github.com" > ~/.git-credentials
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-
-      - name: Install semantic-release and plugins
-        run: >
-          npm install --no-save
-          semantic-release@24
-          @semantic-release/changelog@6
-          @semantic-release/git@10
-          @semantic-release/github@11
-          @semantic-release/commit-analyzer@13
-          @semantic-release/release-notes-generator@14
-          conventional-changelog-conventionalcommits@8
-
-      - name: Run semantic-release
-        env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          GIT_AUTHOR_NAME: github-actions[bot]
-          GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
-          GIT_COMMITTER_NAME: github-actions[bot]
-          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
-        run: npx semantic-release
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
deleted file mode 100644
index 20e6a8d..0000000
--- a/.github/workflows/renovate.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: Renovate
-run-name: Renovate — Dependency Updates
-
-on:
-  # Run on a schedule (every 6 hours) to discover new updates.
-  schedule:
-    - cron: "0 */6 * * *"
-  # Allow manual runs for testing or forcing an update check.
-  workflow_dispatch:
-
-# Only one Renovate run at a time.
-concurrency:
-  group: renovate
-  cancel-in-progress: false
-
-jobs:
-  renovate:
-    name: Renovate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      # Go is required for postUpgradeTasks (go generate runs templ + sqlc).
-      - uses: actions/setup-go@v6
-        with:
-          go-version: "1.26"
-
-      - name: Run Renovate
-        uses: renovatebot/github-action@v46.1.9
-        with:
-          configurationFile: renovate.json5
-          token: ${{ secrets.RENOVATE_TOKEN }}
-        env:
-          LOG_LEVEL: info
-          RENOVATE_REPOSITORIES: ${{ github.repository }}
-          RENOVATE_GIT_AUTHOR: "onion-4-dinner <15676555+onion-4-dinner@users.noreply.github.com>"
-          # Whitelist postUpgradeTasks commands defined in renovate.json5.
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^go generate \\./\\.\\.\\.$$"]'