chore(release): prepare v2.1.0

[beyondwin]

Summary

• publish the v2.1.0 release notes and deployment/readiness evidence
• upgrade Spring Boot to 4.0.7 / Spring Framework 7.0.8 to close the release-image findings and SMTP hostname-verification advisory
• stabilize provider timeout contract tests under CI scheduling load without changing production retry or timeout policy

Release order

Release PR/main CI → annotated tag → server image scan/promote → credential-free SMTP STARTTLS hostname probe → OCI backend health → same-tag frontend deploy → GitHub Release → production smoke.

Verification

• ./scripts/pre-push-check.sh --full --release
• frontend coverage: 223 files / 1,776 tests
• Chromium E2E: 107/107 on isolated local ports and owned Docker MySQL
• Chromium CT: 17/17; design-system 14/14; design-docs 2/2
• server quality and Testcontainers integration; ARM64 release image build
• Trivy 0.70.0 HIGH/CRITICAL: Ubuntu 0, application JARs 0
• Actionlint, Bash, ShellCheck, AI/privacy/config, Prometheus, Tempo, Grafana, Alertmanager, public candidate/gitleaks

Review

Independent release review found three evidence gaps; all were corrected and the scoped re-review is clean with no Critical, Important, or load-bearing findings.

No database migration, destructive rollback, secret change, or release tag movement is included.