v0.9.4

Changes since v0.9.3

• fix(ci): bound dependencies and document key rotation
• fix(ci): keep migration ids and auth fixtures valid
• fix(release): gate publication on protected environment
• chore(release): v0.9.4
• fix(release): fail closed when disclosure policy is unavailable
• fix(release): publish API and dashboard atomically
• fix(alerts): backfill and constrain weekly schedules
• fix(db): commit LTI enum before data migrations
• fix(db): make v0.9.3 migration downgrade non-destructive
• fix(dashboard): make expired sessions terminate once
• fix(auth): make session expiry terminal and refresh rotation tolerant
• fix(canvas): keep OAuth tokens out of download URLs
• fix(canvas): constrain OAuth and API requests to safe origins
• fix(canvas): authenticate OAuth state and validate instance origins
• fix(lti): restrict Canvas placements to staff roles
• fix(jobs): report unavailable execution honestly
• fix(education): enforce Canvas launch scope on scan routes
• fix(canvas): enforce launch scope on content review routes
• fix(canvas): enforce launch scope on course routes
• refactor(auth): preserve authorization context in principals
• fix(auth): invalidate legacy permissive LTI access
• fix(lti): enforce staff-only launch before provisioning
• fix(lti): deny learner and unknown launches