5.1.0

🎬 Session audit & replay — now a first-class feature, on by default

Every terminal session is now recorded and can be replayed from Audit Sessions in the
UI — who ran what, where, and when, side by side for sessions that spanned multiple hosts,
with a text filter to jump straight to the lines that matter.

This feature existed behind enableInternalAudit but was experimental: reviewing a session
loaded its entire output into the browser in one shot, which hung the tab on any session
with real output. That's fixed properly:

• Output streams from the database to the browser and renders incrementally — sessions
  with hundreds of megabytes of terminal output replay without breaking a sweat
• Fixed a server-side cleanup loop that was quadratic in session size and could spin a
  request thread forever when output contained a backspace at the start of a line
• Full ANSI/VT100 control sequences (colors, cursor movement, screen modes, window titles)
  are now stripped from replayed output — no more [?1049h noise from top and friends

Practically every compliance framework has a privileged-access audit-trail requirement
somewhere — PCI DSS, HIPAA, SOC 2, ISO 27001 — and this checks that box without a
commercial PAM product.

Upgrade note: enableInternalAudit now defaults to true on fresh installs; existing
installs keep whatever their persisted config says. Retention is deleteAuditLogAfter
(90 days by default); disable recording entirely with ENABLE_INTERNAL_AUDIT=false. If you
scripted against the old getJSONTermOutputForSession.ktrl endpoint, it's replaced by the
streaming streamTermOutputForSession.ktrl (plain text, one line per record).

🔒 Hardening

• CSRF token comparison is now constant-time

📦 Dependencies

• Bouncy Castle bcprov-jdk18on 1.84 → 1.85
• JUnit Jupiter 6.1.1 → 6.1.2