- validate_config: reject multiple auth-host marks per domain;
sanitize_config clears extras (first wins) and coerces junk entry
values to presence-only
- origin_key: lowercase keys, strip trailing dots (bare hosts/wildcards)
- Passkey._allowlisted: tolerate trailing-dot wildcard bases
- wschat: stamp remote-flow sessions with the session host's domain,
not the approver's
- auth_host redirects: keep the port (redirect to the configured auth
host instead of the normalized, port-less current host)
- update_domain: required fields (wholesale replace) — no silent wipes
- admin: fix pre-existing lockout-guard order in org permission removal;
permission PATCH keeps domain restriction when omitted; 400 instead of
500 on unknown permission UUIDs
- Drop dead code: db.update_config/set_session_host/delete_reset_token,
Session.metadata, oidjwt.clear_key, background aliases,
avatar.current_avatar_url/media_root, wsutil.require_pow
- Prune stale/duplicated comments and docstrings
LeoVasanko