v0.4.8

A maintenance release — no breaking changes; everything is a fix or internal hardening.
Reliability: the configurable whatsapp-web.js first-boot timeout (WWEBJS_AUTH_TIMEOUT_MS) now
actually takes effect in Docker (it was never forwarded into the container) and is validated as a safe
integer; the dashboard now collapses duplicate connection-lost toasts during a reverse-proxy outage.
Resource limits: outbound base64 media is now size-capped (413 when too large) on a par with the
remote-URL and inbound media caps, and bulk-send media payloads are validated as typed objects.
Release & tooling: a published GitHub Release now waits for the container image build, and the data
migration CLI is scoped to the data-owned tables. Note: bulk-send media validation is now stricter — a
bulk request carrying unknown or malformed fields inside a media object is now rejected with 400.

Changed

• A published GitHub Release now waits for the container image build. The release workflow's
  GitHub Release job now depends on the Docker image job, so a v* tag can no longer publish release
  notes without a matching multi-arch image on GHCR. A failed image build leaves the tag without a
  Release until the workflow is re-run. (#389)
• The data migration CLI is scoped to the data-owned tables. data-source.ts (used by
  migration:generate / migration:run) now lists only the data connection's entities
  (session/webhook/message/template/engine), mirroring the runtime data connection, instead of a
  broad glob that also pulled in the main-owned api_keys/audit_logs entities. Generating a data
  migration no longer emits spurious auth/audit DDL into the data database. No runtime or schema
  change for existing installs. (#391)

Fixed

• Dashboard collapses duplicate connection-lost toasts during a reverse-proxy outage. When the
  backend is unreachable behind a reverse proxy that returns a non-JSON 502/503 page, the
  dashboard now folds the repeated request failures into a single connection-lost toast instead of
  stacking ordinary error toasts. The thrown error now always carries the HTTP status code (which the
  toast de-duplication matches on), rather than a status text that is empty over HTTP/2. (#388)
• WWEBJS_AUTH_TIMEOUT_MS now takes effect in Docker, and is validated as a safe integer. The
  configurable first-boot init timeout added in 0.4.7 was never forwarded into the container by Docker
  Compose, so setting it in .env had no effect on the recommended deployment path — the engine kept
  the 30000ms default. Both compose files now pass it through (unset still means the default). The
  value is also validated as a positive safe integer, so an accidental huge or overflowing value falls
  back to the default instead of making the engine's first-boot wait run effectively unbounded. (#393)
• Outbound base64 media is now size-limited. Sending media as a base64 string (single and bulk
  sends) was bounded only by the coarse whole-request BODY_SIZE_LIMIT, unlike remote-URL and inbound
  media which already enforce MEDIA_DOWNLOAD_MAX_BYTES. The decoded size of an outbound base64 blob
  is now checked against the same MEDIA_DOWNLOAD_MAX_BYTES cap (default 50 MiB) before it is sent or
  persisted; an oversized blob is rejected with 413 Payload Too Large (the documented
  MESSAGE_MEDIA_TOO_LARGE). The bulk-send nested media payloads are now validated as typed objects,
  so unknown or malformed media fields are rejected rather than silently persisted — bulk requests
  carrying junk inside a media object will now get a 400. (#394, #395)