v2.15.3

v2.15.3 - upstream security, billing and relay fixes

Ports the confirmed findings from the new-api branch audit: session and
2FA hardening, atomic quota pre-consumption, transactional epay crediting
and task refunds, tiered billing charged by the group actually used on
retry, an upstream response header timeout, postgres/gorm compatibility,
and the classic time-range expression fix plus a startup audit for the
expressions already stored.

Upgrade note: cookie sessions now carry an auth version and a server-side
session record, so every existing login is invalidated. All users have to
sign in again after this deploy.