Release v0.23.0

Breaking changes

• GET /api/v1/config returns a new response format. The response now contains only local node, instance defaults, and backend command/docker summary, all other fields are removed. Check anything that consumes this endpoint.
• Inference API keys are now stored and verified differently (HMAC fingerprint instead of Argon2id hash). Existing keys keep working and migrate automatically on first use. The legacy verification path will be removed in a future release. Keys unused by then must be recreated.

What's Changed

• chore: bump @biomejs/biome from 2.5.6 to 2.6.2 in /webui in the npm-development group by @dependabot[bot] in #286
• chore: bump lucide-react from 1.58.0 to 1.61.0 in /webui in the npm-production group across 1 directory by @dependabot[bot] in #285
• fix: Scrub forwarded credentials, rebuild proxy per generation, and make instance updates transactional by @lordmathis in #287
• chore: bump lucide-react from 1.61.0 to 1.65.0 in /webui in the npm-production group by @dependabot[bot] in #288
• chore: bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 by @dependabot[bot] in #289
• fix: improve error handling and configuration validation during startup by @lordmathis in #290
• Feat: Store inference API keys as HMAC fingerprints by @lordmathis in #291
• Fix: Stop leaking backend credentials via GET /api/v1/config by @lordmathis in #292
• Fix: Workflow permissions and version updates by @lordmathis in #293
• chore: bump lucide-react from 1.65.0 to 1.68.0 in /webui in the npm-production group by @dependabot[bot] in #294
• chore: bump the npm-development group across 1 directory with 3 updates by @dependabot[bot] in #295
• fix: Send proper shutdown signal to process group on Unix by @lordmathis in #296
• chore: Document manual start limit and remove dead code by @lordmathis in #297
• feat: Introduce request body size limits by @lordmathis in #298
• fix: Validate origin for cookie auth by @lordmathis in #299

Full Changelog: v0.22.1...v0.23.0