v1.10.2

Completes the 1.10.0 release. The 1.10.0 and 1.10.1 tags failed the release
vulnerability gate on newly published CVEs, so not all images shipped under
them; use 1.10.2 for all four images. Includes everything listed under 1.10.0.

Security

• Alpine-based images (edge, node-agent, WireGuard) apply base package updates
  at build time and use a current Alpine 3.24 digest, picking up the zlib fix
  for CVE-2026-85091.
• The edge (Caddy) binary is built with Go 1.27.3 and go-jose 4.1.6
  (CVE-2026-111943, CVE-2026-116587).
• golang.org/x/net 0.62.0 in the panel, edge and Terraform provider
  (CVE-2026-78661).

Included from 1.10.0

Feature and bug-fix release driven by user reports. Adds REST API control over
upstream scheme, WAF and rate limiting, a per-route access log endpoint and a
configurable display timezone, and fixes host creation and the DNS check for
API-imported services and DDNS nodes. Rebuilt on Go 1.27.3 with patched
dependencies; updating is recommended. No migrations, no manual steps.

Added

• Route API: upstream_scheme on create/patch/get (#118); per-route WAF and
  rate-limit fields (module-gated like the UI) and
  GET /api/v1/routes/{id}/access-logs (#117).
• HPG_DISPLAY_TZ (IANA zone, default UTC) shows access-log, WAF-event and
  alert timestamps in that zone; storage stays UTC (#116).

Fixed

• Adding a host for a backend IP shared by several API-imported services picks
  the service whose port range contains the port instead of failing with "port
  not in allowed range" (#120).
• The host DNS check resolves a node's public address when it is a hostname or
  DDNS name instead of always reporting a mismatch (#119).
• Host edit keeps the node name and status in the page header after a
  validation error instead of showing them empty.

Security

• Images built with Go 1.27.3 (CVE-2026-111943, crypto/x509) and go-jose 4.1.6
  (CVE-2026-116587).