v2.8.2

TinyIce 2.8.2

Security
  - stored XSS via the branding logo upload (any DJ, any file type)
  - MPD rm deleted arbitrary .pls files via a traversing name
  - /admin/hotswap restarted the server for any account
  - Icecast SOURCE password brute force had no lockout
  - API tokens could mint further (non-expiring) tokens
  - deleted original superadmin resurrected on restart
  - rejected WebRTC offers leaked the peer connection
  - passkey login/begin unbounded server state

Fixed
  - OIDC login behind a TLS-terminating reverse proxy
  - poster uploads limited to video mounts and real JPEGs