feat: add first-time setup wizard and zero-config startup

fix(session-cookie): migrate to __Host- prefix for secure contexts (#294)

feat(refactor): ready for manual QA after main sync (#274)

feat: phase 1 workspace isolation across auth and core APIs (#112)

fix: healthcheck auth, secure cookie auto-detect, model object crash (#84)

feat: audit hardening, webhook retry, and local Claude session tracking (#68)

feat: v1.2.0 — validation hardening, unit tests, quality improvements

feat: add Docker support, session controls, model catalog, API rate limiting

chore: CODE_OF_CONDUCT, issue templates, DELETE patterns, limit caps, CSRF origin check

fix: remove legacy auth, add login rate limiting, block SSRF metadata, parameterize migration SQL

fix: add auth checks on all GET endpoints, timing-safe comparisons, and XSS sanitization

feat: initial open-source release