v0.2.3

Changes

• OAuth maintenance for idle connected accounts now coordinates token refresh
  across replicas (Redis) or locally and shares a lock with request-time
  refresh. Grok Build has a weekly credit usage bar.
• Added an imported-key Windsurf / Devin Desktop connection with a logo,
  mock-tested native chat/stream translation. It is neither Devin CLI (ACP)
  nor browser OAuth; no background token renewal is promised for imported keys.
• Added a master-only Updates dashboard page and
  GET /admin/updates/check. Checking is explicit and reads GitHub's latest
  release metadata; released GHCR builds embed their version. The router
  does not control the Docker daemon or replace containers: operators
  pull a pinned image and recreate their existing deployment without dropping
  volumes. GitHub release metadata can appear before the GHCR image is ready.

Full Changelog: v0.2.2...v0.2.3