docs: document tooling, security, and permission updates

Update README (Testing & Quality, CI Pipeline) and add a 4.2.0
CHANGELOG entry covering the dependency/security refresh, static
analysis, granular permissions, and file manager hardening.

Author: vickym1010

CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## [4.2.0] - 2026-07-21
+
+### Security
+- Refreshed backend dependencies within their existing constraints to clear all reported advisories (`laravel/framework`, `symfony/*`, `guzzlehttp/*`). `composer audit` now reports no vulnerabilities.
+- Refreshed frontend dependencies (`npm audit fix`) to clear all reported advisories, including the high-severity `axios` issues. `npm audit` now reports no vulnerabilities.
+- Restricted the file manager `show` endpoint to an explicit safe field subset so internal columns (storage path, owner id) are never exposed to the client.
+
+### Added
+- Static analysis via Larastan / PHPStan (level 5), wired into `composer analyse` and the CI pipeline.
+- `pint.json` (Laravel preset) plus `composer lint` / `composer lint:test`, with Pint style checking enforced in CI.
+- Dependabot configuration for weekly Composer, npm, and GitHub Actions updates.
+- Pull request template.
+- Feature tests for the granular permission gates and the hardened file manager `show` response.
+
+### Changed
+- Admin routes are now gated with granular Spatie permissions (`role_or_permission:superadmin|<permission>`) instead of only the coarse `superadmin` role, so non-superadmin roles can be granted specific capabilities. Existing superadmin behaviour is unchanged.
+- Adopted route-model binding for user, activity-log, and file routes; the `{file}` binding is scoped to the authenticated user so foreign files resolve to a 404.
+- Form Requests for settings, notifications, and role management now enforce authorization instead of returning `true`.
+
+### Fixed
+- Resolved all PHPStan level 5 findings (reflection type guard, model factory return types, and `list<string>` property annotations).
+
 ## [4.1.0] - 2026-04-24
 
 ### Updated

README.MD

@@ -305,6 +305,12 @@ php artisan route:list --except-vendor
 # Check code style (PSR-12)
 ./vendor/bin/pint --test
 
+# Auto-fix code style
+composer lint
+
+# Run static analysis (Larastan / PHPStan, level 5)
+composer analyse
+
 # Remove development artifacts from vendored public assets
 php artisan assets:prune-vendored
 
@@ -322,11 +328,15 @@ GitHub Actions workflow: `.github/workflows/ci.yml`
 |---|---|
 | PHP 8.4 + SQLite | Environment setup |
 | `composer install` | Backend dependencies |
+| `vendor/bin/pint --test` | Code style check |
+| `vendor/bin/phpstan analyse` | Static analysis (Larastan, level 5) |
 | `php artisan migrate` | Database schema |
 | `php artisan route:list` | Route integrity check |
 | `php artisan test` | Test suite |
 | `npm ci` + `npm run build` | Frontend build |
 
+Dependency updates are automated with [Dependabot](.github/dependabot.yml) (Composer, npm, and GitHub Actions, weekly).
+
 ---
 
 ## Security