Rackpad v1.8.6

This maintenance release patches the production Node runtime and compatible
security dependencies. Confirm the tag's successful publication and immutable
GHCR image digest before installation. Docker on linux/amd64 and linux/arm64
remains the supported deployment.

Security and maintenance

• All three production Docker Node stages use 22.23.4, including the Brotli fix
  for CVE-2026-111497 (#206). Image smoke checks the actual candidate runtime and
  rejects affected Node versions. Historical recovery fixtures stay isolated.
• Compatible MCP, Fastify, Nodemailer, Zod and transitive dependency patches
  address the advisories found during maintenance validation.
• No new listener, environment setting, public route or deployment privilege is
  introduced. MCP remains disabled by default.

Existing published images keep their embedded Node runtime. Pull the new image
and recreate the container after its exact publication succeeds. Native deployments
must update their installed Node runtime separately to 22.23.4 or a newer Node 22
release; updating Rackpad source does not update the host runtime.

Upgrade and rollback

Schema remains 55, matching 1.8.5. This patch adds no migration and retains
existing configuration, inventory and authentication behavior. Before upgrading,
retain a protected consistent database/volume snapshot, configuration, the original
RACKPAD_SECRET_KEY and the matching previous image together. Pin
RACKPAD_TAG=1.8.6 after publication and verify administrator access, monitoring,
connected ports and restart persistence.

Rollback restores the previous image with its paired database/configuration/key
snapshot. Older installations must also follow the applicable
earlier upgrade precautions.

Release validation and limits

Publication requires the repository quality, CodeQL and security gates. The
immutable candidate and published images must pass both AMD64 and ARM64
fresh-install, authenticated-write, upgrade, restart and paired-rollback checks.
Automated tests do not establish reporter acceptance on a private SMTP provider
or a particular Ubuntu bind-mount deployment. Native Proxmox LXC remains
experimental pending its real-guest gates.