v2026.10.20-alpha

Upgrade notes

• Agent logins last months, not an hour. MCP access tokens now last 30
  days and refresh tokens 90 days, renewed on each use. A refresh token its
  own client rotated is admitted again for one access-token lifetime while
  its family is live, so agent processes that share one stored credential,
  such as Codex, no longer sign each other out. Every request still checks
  access tokens against the database, so revocation is immediate.
• Connected agents in Settings. Users see the agents connected to their
  account and can disconnect one at once. Disconnecting, and an
  administrator's revoke-all, also delete pending authorization codes.
• Tokens issued before the upgrade keep their old lifetimes until their next
  refresh. A client signed out before the upgrade signs in again once.

No configuration, Parquet format or migration changes.

What's Changed

• fix(auth): keep MCP agent logins alive and let users disconnect agents by @vishr in #361

Full Changelog: v2026.10.19-alpha...v2026.10.20-alpha