v1.7.9

HN-launch hotfix bundle (rafael + Claude QA-walk 2026-05-27).

Self-host

• Fix /login form POST 403 ("Cross-site POST form submissions are forbidden") via ORIGIN env in installer + shipped docker-compose.yml + .env.example
• New ENV-override banner in Settings → LLM when LYNOX_LLM_PROVIDER is set (prevents silent UI-provider-switch failure)

Provider / session

• Propagate provider + credential swap to long-lived Sessions: engine._configVersion + Session._configVersionAtAgentBuild mirror the existing _registryVersion pattern so Anthropic → Mistral in Settings takes effect on the next chat without logout/login (#42)

UI

• KI badge floats inline with the FIRST TEXT block, not turn-top (was stranded above thinking + tool_calls on Anthropic extended-thinking turns) (#41)
• Remove duplicate ChatView hamburger; AppShell 3-dot kebab is the single thread-actions surface (#43)
• Hosted-BYOK SetupBanner credentials step gets the same back-to-picker button self-host has (#7)
• Reconcile chat thread from server on ChatView re-mount: navigating away mid-stream no longer leaves an empty assistant in the thread view (server-completed response refetched on return) (#13)

Test-Connection

• Whitelist api.mistral.ai + api.anthropic.com from the SSRF disclosure modal (no more "a malicious public endpoint could capture your key" scare for vetted EU-sovereign preset) (#9)

Tests: 5416/5416 vitest pass, web-ui typecheck clean.