v13.96.0

v13.96.0 - 2026-09-25

• 🎉 Login tokens now last 8 days by default & POST /login, POST /login/passkey/authenticate return a refresh token which POST /login/refresh exchanges for a new token pair - the web client refreshes on every launch & each refresh extends the session by 30 days of inactivity, refresh tokens are single use, stored hashed & a replayed token revokes its session
• 🎉 login::token::expiry & login::refresh::expiry admin config values (hours) control the login token & session lifetimes
• 🎉 DELETE /user/:username/session/:session terminates a login session, revoking its login & refresh tokens - the web client calls it on logout & from the sessions list
• 🚀 Session tokens derive their access level & disabled state from the Profile on every request rather than from the token claim
• 🚀 Terminating a session (logout, admin termination, user disable or refresh token reuse) sends a logout message to its open WebSocket clients & closes them - the web client wipes local state & returns to login
• 🐛 Editing a Connection that has no channel memberships no longer disables the Save button, which blocked saving a regenerated certificate

�