v1.0.39

Security: Added brute-force PIN rate-limiting and session token clearing on logout. UX: Prevented inactivity locks during video playback. Performance: Saved uploaded profile avatars to server disk instead of configuration strings. Admin: Added per-user profile limits and switch audit logs.