ManUp v0.3.0

🔒 Security & permissions hardening

• Scoped API keys — keys can now be created with full or read-only scope. A read-only key is rejected on any non-GET request, even if the underlying user could otherwise write — good for monitoring/export jobs that should never be able to mutate secrets. See the API Keys wiki page.
• Brute-force protection on auth — /register (5/min) and /login (10/min) are now IP-rate-limited, independent of API key rate limits.
• Password confirmation required to change your own email/username, or to delete your own account.
• Organization owner can no longer delete their own account — prevents an org from accidentally ending up ownerless. Delete the organization instead if that's really the intent.
• Tighter organization/member management guards: only owner/admin can update org details or remove members; only owner can delete the organization; the org owner can't be removed via member management; you can't remove yourself through that endpoint.

See RBAC and Permissions on the wiki for the full breakdown.

Other changes

• Client UI refactor — Sidebar and modal/view components split out of the main app file for maintainability.
• Various formatting/config cleanup.

Docker images

docker pull procoder588/manup:0.3.0
# or
docker pull ghcr.io/amanbig/manup:0.3.0

---

What's Changed

• Feat/security enhancements by @Amanbig in #1

New Contributors

• @Amanbig made their first contribution in #1

Full Changelog: v0.2.0...v0.3.0