v1.0.4

What's Changed

• test(security): pin csrf_token + {{ user }} survive WS re-renders (#1779, T9) @johnrtipton (#1783)
• docs(security): recommend setting LIVEVIEW_ALLOWED_MODULES (#1778, threat model T4) @johnrtipton (#1782)
• feat(websocket): opt-in per-event auth re-check (#1777, threat model T3) @johnrtipton (#1781)
• fix(websocket): close socket on auth/hook mount redirects — auth bypass (threat model T1/T2) @johnrtipton (#1780)
• feat(nav): opt-in auto_navigate link interception (#1734, #1735, ADR-021 Stage 2) @johnrtipton (#1776)
• fix(routing): auth-filter the client route map (#1758, ADR-021 Stage 2) @johnrtipton (#1775)
• docs(best-practices): add Deployment section (platform env contract + deploy doctor) @johnrtipton (#1774)
• fix(deploy): deploy doctor honors env-derived DATABASES, not just DATABASE_URL (#1768) @johnrtipton (#1773)
• test(isolation): restore app-registered tag handlers in _isolate_tag_registries (#1771) @johnrtipton (#1772)
• security(deps): bump pyo3 0.25 → 0.29 (GHSA-36hh-v3qg-5jq4 + GHSA-chgr-c6px-7xpp) [#103, #104] @johnrtipton (#1770)
• fix(theming): log the swallowed theme-context cache-write skip (#2380) @johnrtipton (#1769)
• deps: bump eslint-plugin-security from 4.0.0 to 4.0.1 @dependabot[bot] (#1764)
• deps: bump happy-dom from 20.10.1 to 20.10.2 @dependabot[bot] (#1763)
• deps: bump smallvec from 1.15.1 to 1.15.2 @dependabot[bot] (#1766)
• deps: bump uuid from 1.23.2 to 1.23.3 @dependabot[bot] (#1765)
• deps: bump regex from 1.12.3 to 1.12.4 @dependabot[bot] (#1762)
• feat(deploy): deploy doctor preflight + serving_current rollout status (#1760, #1761) @johnrtipton (#1767)
• fix(deploy): respect .gitignore in deploy tarball + warn on oversized uploads @johnrtipton (#1759)

Full Changelog: v1.0.3...v1.0.4