3.0.0

Features

• Added internal API token rotation support via POST /api-token/rotate.
• Online Redis records now consistently track modifiedAt, preserving createdAt and refreshing modifiedAt on updates.

Bug fixes and security fixes

• Fixed FCM token update error handling so Redis scan failures now return 500 Internal Server Error instead of being silently ignored.
• Removed apiToken from online-state GET responses and tightened token handling across logs, debug output, and comparisons.
• Removed committed Rocket secret keys; deployments must provide ROCKET_SECRET_KEY.
• Strengthened request validation for UUID path parameters and POST /fcmtoken input.
• Reduced information leakage by returning uniform 404 Not found responses for missing or corrupt Redis records.
• Reworked FCM token lookup to avoid loading full Redis records unnecessarily.

Idiomatic Rust improvements

• Cleaned up Rust style across models, handlers, and Redis helpers.
• Reduced unnecessary allocations, cloning, panics, and repeated environment reads while keeping the external JSON API unchanged.

Tests

• Updated integration coverage for online-state GET responses after removing apiToken from the response body.