v1.3.1

Security

• Entitlements are now product-stamped: one KelTech signing key serves every
  KelTech app, so each app rejects entitlements issued for a different
  product. Prevents a license for one product from unlocking another via the
  offline-file path. Legacy full keys are unaffected.

Changed

• License page: the air-gapped note now links the offline license file
  generator (idpvault.com/offline-license) next to the upload control.

Fixed

• Deleting a tenant failed with a 500 for any tenant that had ever run a
  backup (foreign-key violation on its snapshot history). Delete now removes
  the tenant's history rows (state, snapshots, runs, events, jobs) and its
  on-disk data in the same operation - the files would be undecryptable
  without the tenant's data key anyway.