v26.10.2 — safer configuration: env variables are enforced, dead keys are reported, and the docs match the code

Upgrade notes — four changes can stop an existing config from starting

• server: block is an error. flAPI never read it. Use http-port / http-host, --port / --host, or FLAPI_PORT / FLAPI_HOST.
• template.environment-whitelist is now enforced for YAML files. An unlisted {{env.NAME}} stops startup and names the variable. An empty or missing whitelist allows none. A top-level environment-whitelist: is an error; it belongs under template:.
• Included files are covered too. {{env.NAME}} inside an {{include}}d file is now substituted and checked. An auth.users entry with an empty username or password stops startup.
• Spaced references are substituted. {{ env.NAME }} in YAML now works instead of staying literal. ${NAME} is still not supported.

Added

• Unknown top-level keys in flapi.yaml now log a warning, with hints for near-misses such as rate-limit vs rate_limit and https vs enforce-https.
• flapi pack validates the config first and writes no bundle if it is invalid (--skip-validation opts out).

Fixed

• --validate-config accepts MCP prompt files, and every shipped example now validates.
• The config dump shown when a config fails to load no longer prints passwords from the environment.
• GET /api/v1/_config/environment-variables lists the variables that match whitelist patterns.
• flapi_create_endpoint now saves the endpoint, accepts template-source and connection, and the endpoint serves and survives a restart. flapi_delete_endpoint removes the endpoint's YAML file.
• flapii project init generates a config flAPI actually reads.
• Three mcp.* settings that did nothing now warn that they are ignored.
• Docs and examples no longer show ${VAR} or a top-level https: block, neither of which flAPI reads.

Docker

:latest now points to the latest release.