[TheStreamCode]

Summary

• introduce a shared admin design system across the File Manager, Settings, Groups, Quotas, Notifications, Reports and Activity Log
• remove the WordPress footer band and the gray gap above the plugin panels on every TeamVault screen; the File Manager now fills the viewport and pins the storage panel to the bottom edge
• redesign the File Manager toolbar, cards, details panel, popovers, modals and empty states; add responsive and mobile fixes
• improve accessibility: screen-reader page heading, focus-visible states, AA text/badge contrast, labeled filter popover with aria-expanded, accessible icon-only Export, 44px touch targets
• merge the already-reviewed 3.4.x storage hardening: uniqueness migration and dedupe, 409 duplicate handling, atomic reindex claim, fail-closed storage protection
• update i18n (Members label in four language maps + POT), tests and release metadata for 3.5.0

Verification

• composer validate --strict, composer audit --locked, composer ci: clean (PHP lint 101 files; PHPUnit 223 tests, 776 assertions, 2 skipped)
• JavaScript syntax checks and node --test tests/pdm-helpers.test.mjs tests/plugin-check-output.test.mjs: 33 pass
• WordPress Plugin Check on a clean runtime payload on the active WordPress 7.1.3 staging install: no errors
• upgrade path 3.4.0 -> 3.5.0 applied the uniqueness migration (unique indexes present) and set the installed version
• scripted browser QA on the active install: 33/33 checks passed (file upload, preview, download, rename, move, ZIP export endpoint, delete, settings save, reindex maintenance, groups create/delete, notifications/quotas save, reports, activity log, mobile drawer/details, no console errors)
• release ZIP built from the release revision matches the WordPress.org runtime payload file list and SHA-256 hashes (57 files)

Release note

This release unifies the TeamVault admin interface and hardens storage data integrity and protection. The first update runs a one-time duplicate-record merge automatically; Nginx sites must confirm a deny rule for the private storage directory or use an out-of-webroot storage path, while Apache/IIS setups need no configuration changes.