1.0.0-beta2
Security and bug-fix release:
- Security: close IDOR in /user/{user}/manage-subscription (subscription ownership now enforced)
- Security: unforgeable HMAC-signed post-purchase auto-login tokens
- Performance: defer remote billing sync off the login path
- Resolve deploy-review findings from the contrib decoupling refactor