SigardaPanel v1.2.0

SigardaPanel v1.2.0 — the open-source release.

Session security: browser sessions now use an HttpOnly, Secure, SameSite=Strict cookie instead of a token in localStorage, so XSS can no longer steal the panel session. Bearer tokens remain available for API clients; impersonation is in-memory only and no longer persists tokens to disk. Users will be signed in again after upgrading.

Self-hosting: public sign-up can be closed with SIGARDAPANEL_ALLOW_REGISTRATION=false.

Also in this release: worker panic recovery (a failing job can no longer crash the panel), site deletion now drops its MySQL databases, login rate-limiter memory hygiene, internal error detail no longer leaks through user-facing APIs, and the agent installer pins the latest signed release.

Every file is signed (see 'Verifying releases').