Release v2.25.0

What's Changed

• fix(byok): local-only-MCP org BYOK via existing /stream/org proxy (no lease) by @chelojimenez in #3107
• feat(xaa): org-scoped mock-IdP issuers (/api/web/xaa/o/) by @chelojimenez in #3103
• docs(analytics): flag audit + migration guide + backend twins plan by @chelojimenez in #3108
• feat(xaa): opt-in hosted issuer for local debugger runs — no tunnel needed by @chelojimenez in #3104
• refactor(computers): service-token-only auth + drop three-var compat (inspector) by @chelojimenez in #3102
• refactor(computers): RS256-only terminal-token verify (drop HS256) by @chelojimenez in #3106
• feat(xaa): mock OIDC IdP — code flow with PKCE, standard /token, userinfo by @chelojimenez in #3105
• refactor(analytics): complete track() migration — remove all raw posthog.capture() by @chelojimenez in #3116
• feat(swarm): split Chatbox (human) and Swarm (agent) surfaces by @chelojimenez in #3112
• refactor(analytics): complete track() migration — remove all remaining raw posthog.capture() by @chelojimenez in #3119

Full Changelog: v2.24.0...v2.25.0