4.9.0

• ASB+CONTROLLER: The JSON-RPC server now requires authentication. The ASB verifies a password against a hashed keyfile (--rpc-auth-file), and asb-controller prompts for the password on startup. Generate the keyfile with orchestrator gen-rpc-auth. Clients authenticate by sending the password with every request in an Authorization: Bearer <password> header.
• ASB+GUI: Skip publishing the Monero redeem/refund transaction if it is already present on chain (e.g. after a restart)