Build first working version of IJSS for Tumblr

- Folder browser: choose an IJSS folder, create tag folders, add images
  by drag-and-drop or Open panel, with thumbnails and Finder sync
- Duplicate detection: SHA-256 fingerprints checked against a SwiftData
  (SQLite) history of posted images
- Tumblr login via OAuth 2 with a localhost redirect; tokens kept in the
  Keychain and refreshed automatically
- Posting to the Tumblr queue with folder names as tags, mixed or
  folder-by-folder order, a courtesy delay, progress, and a summary;
  posted images are archived to _Posted/<Tag>/
- Settings for the folder, Tumblr account, posting options, and clearing
  posted history (archive goes to the Trash)
- TODO.md tracking open items

Tumblr app credentials live in TumblrCredentials.plist, which is
excluded from Git.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

TODO.md

@@ -0,0 +1,32 @@
+# IJSS To Do
+
+A running list of what's still open. Add notes from day-to-day use under **Notes from Testing**.
+
+## Planned Features
+
+- [ ] **Caption setting** — Optional caption text for posts (currently image-only with the folder name as the tag).
+- [ ] **More services** — Add other sites alongside Tumblr (the folder layout already allows one folder per service).
+
+## Before Sharing the App
+
+- [ ] **Signing team** — Choose a team under *Signing & Capabilities* in Xcode. This also stops the Keychain "allow access" prompts after rebuilds.
+- [ ] **Hardened Runtime** — Turn on in *Signing & Capabilities* (required for notarization).
+- [ ] **Developer ID + notarization** — Needs a paid Apple Developer account. Export with *Product ▸ Archive ▸ Distribute App ▸ Direct Distribution*.
+- [ ] **Credentials setup for a fresh clone** — `TumblrCredentials.plist` is ignored by Git, so a new checkout won't have it. Add setup instructions to the README (or an example file) explaining how to create it with the OAuth Consumer Key and Secret Key.
+- [ ] **Client secret in the app** — The Tumblr secret ships inside the app bundle. Acceptable for now; revisit before a public release (e.g., obfuscation or a small relay server).
+- [ ] **App icon** — `Assets.xcassets` has no icon yet.
+
+## Known Limitations
+
+- [ ] **Daily limit counting** — The 250-posts-per-day check counts from local midnight, but Tumblr uses its own clock, so the count can be slightly off near midnight. Tumblr still stops posting if the real limit is hit.
+- [ ] **Tumblr queue size** — Tumblr's queue holds about 300 posts. IJSS doesn't check how full the queue is before posting; it stops after 3 failures in a row instead.
+- [ ] **WebP uploads** — Allowed, but not confirmed by Tumblr's docs (which list JPG, GIF, and PNG). Test a WebP file.
+- [ ] **Unsupported formats** — HEIC, TIFF, and similar files are skipped. Could convert them to JPEG automatically before uploading.
+- [ ] **Quitting while posting** — Quitting mid-run stops posting without a warning. Images already posted are recorded and archived, so nothing is posted twice, but a "posting is in progress" warning would be friendlier.
+- [ ] **Login port** — Login uses `http://localhost:8765/oauth-callback`. If another app ever uses port 8765, the port must be changed in `TumblrCredentials.swift` *and* in the app's settings on tumblr.com/oauth/apps.
+
+## Notes from Testing
+
+<!-- Add changes, bugs, and feature ideas here as you use the app. -->
+
+-