2.4.0-rc.5

Highlights

Observability hardening across auth, FGA, and OAuth 2.1 rejection paths (#709) — a systematic pass closing silent failure/rejection points found by auditing every code path touched by the recent SCIM/FGA/SAML/OAuth-hardening/async work, verified through independent security, Go-idiom, Prometheus, and principal-engineer review passes before merge.

• OAuth 2.1/RFC 8707 rejection branches in /authorize and /oauth/token (repeated/invalid resource indicator, unsupported JAR request/request_uri, missing response_type, PKCE-plain and bare-token response_type under --oauth21-strict, token-exchange resource mismatch) now log and — for the genuinely attack-shaped rejections — emit a authorizer_security_events_total sample, instead of failing silently.
• SCIM group provisioning's OpenFGA tuple writes/deletes are now logged on failure instead of a discarded error; FGA engine instrumentation (tuple writes/deletes/reads, list users, expand, write model, reset) moved down into the OpenFGA engine wrapper itself so every caller — including SCIM, which had none — gets it for free.
• Three previously-uninstrumented FGA decision call sites now report to authorizer_fga_checks_total/authorizer_fga_check_duration_seconds: session/token required_relations gating, SAML group assertion, and JWT role derivation.
• asyncutil.Go's panic recovery now captures a stack trace and increments a new authorizer_panics_recovered_total counter — the single chokepoint every fire-and-forget background goroutine in the app routes through.
• The gRPC auth interceptor's admin public-bypass tighten (a mis-annotated admin RPC still getting correctly denied) and rejected X-Authorizer-URL headers are now logged.
• OTP/TOTP lockout logs are now Warn-level with a security-event metric, rebuilt from a fresh logger carrying only the opaque user_id (not raw email/phone) to avoid promoting PII into logs that actually emit in production.
• Cascade-delete transaction failures (DeleteOrganization, DeleteClient, DeleteWebhook, DeleteUser) now log on rollback instead of failing silently.
• Fixed an unrelated pre-existing data race in AuthorizeHandler where the request logger was captured outside its closure and mutated inside it across concurrent requests.

Also in this RC (since 2.4.0-rc.4):

• SCIM: filter operators, provisioning webhooks, and full user PATCH support (#705).
• Fire-and-forget background work (email/SMS sends, webhooks, audit logs) is now tracked and drained on graceful shutdown, with panics recovered instead of crashing the process (#696).
• Trusted base URL (--url) closing a host-header-spoofing class, and per-user email/SMS OTP brute-force lockout (#698).
• UpdateUsers empty-ids guard enforced across all 13 database providers, and cascade deletes wrapped in transactions (#699).
• gRPC admin service returns properly-typed errors instead of generic Internal, and the public-method bypass is scoped tightly (#700).
• Guarded two unguarded type assertions on untrusted input that could crash the process (#701).
• Dashboard: verified organization domains UI (#707), CSV import and InputField crash fixes, WCAG label association fixes (#702, #703, #708).
• New end-to-end regression test for signup webhook firing (#706).

This is a release candidate (pre-release). Run make test-all-db cross-DB validation before promoting to a stable release.