Rackpad 1.8.7-beta.1

This beta follows beta.0 with audit-history and notification
diagnostic fixes.

Changes to test

• Audit events retain their recorded lab ownership after inventory deletion.
  Deletion events are written atomically with the mutation. Current lab grants
  still govern access, including both endpoints of cross-lab links (#211).
• Disabled notification tests explain that notifications must first be enabled
  and saved. Failed tests record sanitized diagnostics in history. History-load
  failures do not change a successful notification result (#199, #202).
• Notification tests use saved settings. Save and test actions cannot overlap.

Upgrade and rollback

Schema is 58. Migration 58 adds nullable audit lab scope and an entity-history
index. Existing history is scoped where the subject can still be resolved;
already-deleted or unknown subjects remain admin-only. Unknown scopes are not
reassigned when an ID is reused later. Logical and native backups preserve stored
scope, including deleted lab IDs; older logical snapshots backfill resolvable
subjects once during restore.

Keep the previous image/binary with its consistent pre-upgrade database,
configuration and secret key. Rollback restores that complete pair. Do not run
older binaries against a schema-58 database.

Acceptance and publication

CI pins the published beta.0 schema-57 image (revision 7bf2eaf484daa5c878154a5d1f828528daff7bff) alongside the older schema-51/53/55 baselines. Its upgrade checks retain known and unresolved audit history, verify scope backfill, delete a fixture subject, restart, and restore the protected old database/configuration/key pair. The workflow targets both AMD64 and ARM64; this is a required check, not a claim that it has run.

Run the standard/full gates, Chromium/Firefox acceptance, storage compatibility
and candidate image upgrade/restart/paired-rollback checks before publication.
Renew the committed-tree CodeQL exception approval through independent review
after the final server changes are committed. The AMD64 candidate gate runs real
Mailpit STARTTLS/SMTPS and ntfy HTTPS/token delivery, saved-settings restart,
authentication/certificate failures and token revocation in disposable Docker
fixtures. Delivery to the reporter's actual mailbox or mobile client still needs
confirmation. No new listener, environment variable or deployment privilege is
introduced.