Latch v0.4.3.0

Added

• Admin catalog plugin install — Admin → Plugins lists the Latch-plugins catalog and installs release zips with the same audit gate as plugin install.
• php bin/latch totp reset <username> --confirm — operator recovery when 2FA codes fail after an encryption_key mismatch.
• PluginCatalog / PluginReleaseDownloader — fetches catalog.json, caches it, downloads GitHub release assets (API fallback when direct zip URL 404s).

Fixed

• Admin SPA plugin actions — error flashes from catalog install are no longer wiped by an immediate in-panel reload.
• Staff JSON errors — failed admin AJAX actions now also set session flash so messages survive navigation.

Upgrade: tarball + scripts/update.sh, or sudo dnf upgrade latch after COPR publishes the RPM.

Full checklist for maintainers: docs/RELEASE.md