v4.7.0

What's Changed

• docs(release): post-tag housekeeping — record v4.6.0 as latest tag by @dknauss in #176
• test(e2e): harden multisite stack smoke, re-scope lane into release gate by @dknauss in #177
• feat(editor): in-editor reauth — Milestone A (password path) by @dknauss in #178
• docs: pre-release demo fix, canonical editor-scope doc, and lockdown research by @dknauss in #179
• fix(demo): make in-editor reauth demo self-guiding (open inserter + notice) by @dknauss in #180
• docs(readme): describe the self-guiding in-editor reauth demo by @dknauss in #181
• docs(planning): in-editor sudo session-indicator research todo by @dknauss in #182
• chore: ignore .codex/ and .playwright-mcp/ agent artifacts by @dknauss in #183
• docs: reconcile planning/roadmap state to post-v4.5 editor-reauth reality by @dknauss in #184
• feat(editor): in-editor 2FA — Milestone B (server-rendered provider partial) by @dknauss in #185
• fix(challenge): strip provider _ajax_nonce before the full-page 2FA submit by @dknauss in #186
• docs(demo): add in-editor 2FA Playground blueprint (Milestone B) by @dknauss in #187
• fix(demo): let the in-editor 2FA blueprint reach the editor by @dknauss in #189
• docs(state): close out the In-Editor Reauth track by @dknauss in #190
• Enhance README with demo and reauth details by @dknauss in #191
• fix(demo): list several rolling TOTP codes in the in-editor 2FA notice (supersedes #188) by @dknauss in #192
• docs(readme): add in-editor two-factor modal screenshot by @dknauss in #193
• Clarify reauth demo link in README by @dknauss in #194
• feat(demo): multisite/network-admin scenario blueprint (#72) by @dknauss in #196
• docs(readme): feature multisite demo as a 5th Playground badge by @dknauss in #197
• docs(state): handoff — record demo/docs arc, leave #67 unclaimed by @dknauss in #198
• release: v4.7.0 — in-editor reauth modal (Milestones A + B) by @dknauss in #199

Full Changelog: v4.6.0...v4.7.0