v0.8.7 — Portal fixes + Web-Session revocation + Mobile-App track

📖 Full changelog: https://github.com/RainerNeu1012/itdatex-mailguard/blob/master/CHANGELOG.md

Release v0.8.7

Bugfix follow-up to 0.8.6, plus everything 0.8.6 shipped
(there was no v0.8.6 tag, so this covers both).

Portal / Devices page

• fix: register 'devices' in router.js so the Geräte header button
  actually routes to the page (was hitting not-found)
• fix: self-revoke redirect now uses portalUrl('login') — was
  resolving relative and landing on /portal/devices/login

Web-session revocation (0.8.6)

• New mg_web_sessions table tracks cookie sessions per JTI, UA, IP.
• Token::verify_session checks a wp_options JTI blacklist; auto-
  prunes expired entries at each revoke.
• Session::start inserts a tracking row, ::destroy revokes it.
• REST GET/DELETE /me/web-sessions.
• Devices.jsx shows Browser-Sessions with 'this browser' badge,
  cross-revoke and self-revoke both wired end-to-end.

Mobile-app track (0.8.6)

• Long-lived Bearer tokens with refresh rotation (Customer\ApiToken
  • mg_api_tokens).
• CORS allowlist scoped to the plugin REST namespace (Rest\Cors).
• FCM v1 push provider (Notify\PushService/Device/Hooks +
  mg_push_devices). Silent no-op until the FCM service-account JSON
  is entered in admin settings.
• Notify hooks fire on dangerous verdict, auto-quarantine, undo
  expiry (daily cron), and unsub bounce.
• IMAP folder auto-sync per pull.

Purge fix (0.8.4)

• Bulk-delete on grouped-by-sender no longer times out (batched
  connection + move-to-quarantine + safe expunge).
• Legacy quarantine actions with target_uid=0 and no Message-ID
  now soft-purge instead of hard-failing on HTTP 502.

Schema bumped to v14 (dbDelta idempotent).