v0.6.0

Changelog

• 4fd5b2a: Admin rights: realm.yaml roles take admin: true or a list of areas (@fernandezvara)
• 97e7a64: Admin rights: the /_admin endpoints check the area, and nobody grants more than they hold (@fernandezvara)
• 0280690: Docs: Prefer: respond-async (calling functions, jobs, JavaScript client, CORS) (@fernandezvara)
• f05ecf2: Docs: admin rights per role (areas, the escalation rules, audit, checklist) (@fernandezvara)
• 4862c5f: Docs: login_throttle (realm settings, brute-force protection, template comments) (@fernandezvara)
• 82346fa: Docs: soft delete (collection.yaml, documents, querying, rules, erasure, JS client, template) (@fernandezvara)
• 4ffb944: JavaScript client: deleted on list and get, restore, purge (@fernandezvara)
• 7a8eb9c: Merge pull request #100 from fernandezvara/47-sync-async-per-call (@fernandezvara)
• ef7594b: Merge pull request #97 from fernandezvara/50-admin-capabilities (@fernandezvara)
• 8cd930b: Merge pull request #98 from fernandezvara/30-login-throttle (@fernandezvara)
• 408c52a: Merge pull request #99 from fernandezvara/39-soft-delete (@fernandezvara)
• cabe1f9: Merge remote-tracking branch 'origin/main' into 30-login-throttle (@fernandezvara)
• bae07fa: Prefer: respond-async runs a sync function as a job (@fernandezvara)
• 154f65e: Soft delete over HTTP: DELETE marks, deleted=only|include, restore, purge (@fernandezvara)
• bafbe64: Soft delete: MongoDB builds the TTL index and flags the pre-soft-delete unique index (@fernandezvara)
• e6a99cd: Soft delete: collection.yaml soft_delete, restore and purge rules, unique indexes with the deletion marker (@fernandezvara)
• 66e1a73: Test harness declares the ops role of the JS integration realm (@fernandezvara)
• 168e0f3: bootstrap: keep the 'isn't an admin role' wording (@fernandezvara)
• 64400b1: login_throttle: a realm tunes its login throttling (@fernandezvara)
• 553e6b3: rules test: restore and purge assertions, and the deleted marks in fixtures (@fernandezvara)
• 75186e5: shelf tour: wait for the digest mail instead of reading the mailbox once (@fernandezvara)

Container images: docker pull ghcr.io/fernandezvara/backd:v0.6.0 and ghcr.io/fernandezvara/backd-executor:v0.6.0 (linux/amd64 and linux/arm64), signed with cosign (keyless) and published with their SBOM and provenance.
Verify downloads against checksums.txt; each archive has an SPDX SBOM (*.sbom.json).