Release 2.6.0

✨ Features

• altmount: add AltMount core service automation (9b5d2c2)
• arr: add optional PostgreSQL mode for supported Arr services (934316e), closes #156
• enhance _collect_arr_entries to preserve existing download_uncached state (b5ff6eb)

🐛 Bug Fixes

• auth: handle invalid PyJWT tokens (a601afc)
• config: enhance config loading with path resolution and defaults (76c7f2c)
• config: normalize legacy riven_backend configuration and add validation tests (b2999ba)
• config: preserve direct rclone credentials across restarts (9656b48)
• download: prevent archive extraction path traversal (1466afe)
• logger: improve log directory creation and permissions handling (0f69c42)
• logger: redact common credential fields in subprocess logs (8804f92)
• prowlarr: repair custom indexer sync for Whisparr (b23fa76)
• security: remove shell usage from user password setup (14e8b9c)
• security: replace exec parsing with AST literals (16dd73f)
• security: require timeouts for requests calls (f2126e1)
• security: use defusedxml for XML parsing (a7f59e2)
• security: validate urllib URL schemes (6905d7b)
• tests: add unit test for AltMount version check and update version handling (89ed8f2)
• update formatting logic in category handling for prowlarr settings (b5ff6eb), closes #223
• update query parameter handling in prowlarr settings (f263cfe)

🤡 Other Changes

• config: refresh env example for rclone credentials (1d09fcc)
• deps: add pre-commit dependency to dev group in pyproject.toml (74b35cb)
• deps: update dependencies (0579533)
• deps: update dependencies (c89031d)
• deps: update dependencies to latest versions (5e0f224)
• deps: update poetry.lock with new development dependencies (74b35cb)
• docker: verify required dockerignore patterns (aa50c5d)
• env: add make targets for env example generation (20c5cfb)
• env: generate env example from config defaults (1bf4189)
• pre-commit: create .pre-commit-config.yaml for local hooks (74b35cb)
• security: add backend security validation gates and hardening tests (a40a62e)
• security: add dependency vulnerability audit target (de80084)

📖 Documentation

• add Black formatting instructions to contributing guidelines (b5ff6eb)
• add repository agent guidelines (#230) (3304d32)
• CONTRIBUTING: update local checks section for pre-commit hooks installation instructions (74b35cb)

🚀 CI/CD Pipeline

• devcontainer: add pre-commit hooks installation to postCreateCommand (74b35cb)

🔧 Testing

• api: add API state update notice coverage (f3db11b)
• auth: add dependency auth coverage (53fd30d)
• auth: add token and password utility coverage (a601afc)
• ci: add backend verification gates and regression coverage (3dace09)
• ci: cover project verification guards (a43de44)
• config: add schema validation coverage (ca3c1e4)
• config: cover config update validation behavior (ea992ba)
• config: cover service UI direct URL normalization (53f1269)
• dependencies: cover shared dependency wiring (5ed1bae)
• download: add archive extraction traversal coverage (1466afe)
• logger: add credential redaction coverage (8804f92)
• process: add response sanitizer coverage (aac58ea)
• process: add symlink manifest path guard coverage (e7bf456)
• process: add update notice helper coverage (168c5cb)
• security: add CORS compatibility checks and hardening coverage (637c61e)

🎨 Styles

• prowlarr: format Whisparr custom indexer changes (d249306)