v0.19.0

Security

• Update klauspost/compress to 1.20.3, fixing a panic on two-block frames
  (GHSA-fpmh-frq8-7rj8, CVE-2026-116591). High
  severity. Affects Pando 0.1.0 through 0.18.0.
• Update crewjam/saml to 0.5.2, fixing NameID spoofing from a foreign XML namespace in a signed
  assertion (GO-2026-6909). No published severity. It needs an
  assertion the configured provider signed. Affects Pando 0.4.0 through 0.18.0 with SAML sign-in configured.

Added

• Webhook routes let a private app receive webhooks (R-425 – R-433). A route names one method and exact
  path and how to verify the sender, an HMAC-SHA256 signature or a secret in a header, and the rest of the
  app stays private. The secret is generated or pasted, and a signature the app already accepted is not
  forwarded again. Manage routes from the app's settings, pando app webhook-route, MCP or the API. Host
  policy's disable_webhook_routes turns them off.