Changes

• test: cover QueryHelper operators, LocalCache, and infra monitor-step utils
  • PR: #3304
• feat: Security Events — SIEM signals in ClickHouse with Sigma detections-as-code and Google SecOps integration
  • PR: #3308
• fix(permissions): lock create/update/delete buttons instead of hiding them
  • PR: #3310
• fix(permissions): let a domain-scoped role read the workspace it needs
  • PR: #3311
• fix(workers): sweep the legacy AIAgentTask cron definitions from Redis
  • PR: #3303
• feat(measurements): named milestone durations for incidents, alerts and scheduled maintenance
  • PR: #3317
• feat(admin): give a master admin full MFA control over any user
  • PR: #3314
• fix: GET /heartbeat/:secretkey returns Dashboard HTML and does not register h...
  • PR: #3316
• test(measurements): pin the backfill column contract the casts cannot type
  • PR: #3325
• fix(topology): judge site-scoped link rules on the whole fleet, not the map's page
  • PR: #3327
• feat(saved views): search and a collapsed tail, like the facets beside them
  • PR: #3328
• fix(admin): stop a mandated user turning their own two factor auth off
  • PR: #3326
• feat(discovery): filter discovered hosts by SNMP / No SNMP before import
  • PR: #3324
• test: pin the /heartbeat -> /incoming-request route reservation (#2986)
  • PR: #3323
• fix(identity): bound guessing on the anonymous credential routes
  • PR: #3332
• fix(accounts): read the login misc bag under its wire key
  • PR: #3330
• feat(logs): surface top errors and time-based correlation on the Logs Insights page
  • PR: #3331
• feat(topology): enter the network map through the site hierarchy
  • PR: #3329
• fix(saved views): make the collapse toggle and the search box tell the truth
  • PR: #3341
• fix(topology): correct five defects an adversarial review found in the hierarchy map
  • PR: #3340
• fix(analytics): bind fractional attribute thresholds as Double, not Int32
  • PR: #3338
• fix(logs): correct seven defects in the Insights error-pattern engine
  • PR: #3336
• feat(Telemetry): computed LLM cost, conversation grouping, and daily LLM cost budgets
  • PR: #3337
• fix(discovery): harden the SNMP / No SNMP review filter, and test it properly
  • PR: #3334
• test: close a false-pass hole in the heartbeat route reservation test
  • PR: #3333
• fix(topology): unbreak compile-dashboard by using an IconProp that exists
  • PR: #3342
• fix(logs): stop attribute filter operators from crashing the log monitor criteria form
  • PR: #3339
• Docs: AI gateway observability (LiteLLM, Portkey) and async agent circuit breaking
  • PR: #3344
• feat(Telemetry): per-project custom LLM pricing overrides
  • PR: #3345
• fix(frontend): stop the SPA fallbacks swallowing root-mounted ingest GETs
  • PR: #3343
• feat(monitor): baseline anomaly detection for Traces and Logs monitors
  • PR: #3346
• fix(dashboard): file the Measurements settings page under Settings, in the menu tests and the breadcrumbs
  • PR: #3335
• fix(monitor): name attribute filter operators on the criteria page
  • PR: #3348
• docs(analytics): star the activation key events now that they fire
  • PR: #3349
• fix(telemetry): repair OtelTracesDropFilterDeferral test after LLM cost changes
  • PR: #3350
• test(telemetry): add unit tests for LlmModelPriceService
  • PR: #3351
• test(measurement): add unit tests for MeasurementMetricWriter
  • PR: #3352
• test(frontend): derive the route-reservation guard from the AST, add behaviour tests
  • PR: #3353
• fix(telemetry): fix Compile job — tsc errors under exactOptionalPropertyTypes
  • PR: #3354