Changes

• fix(billing): SMS, call, WhatsApp and Telegram balance changes are one statement; one charge per recharge
  • PR: #4521
• VMware agent: install without Docker, as a systemd service
  • PR: #4523
• fix(status-pages): a scheduled announcement's images stay private until it shows; cache purges are never lost
  • PR: #4522
• Live updates end with the session that opened them, and the realtime join asks what the API asks
  • PR: #4525
• fix(permissions): one record rule for every read, update and delete, across projects and through the records a record names
  • PR: #4526
• Leaving a project ends connected clients, SSO confirmation and calendar access; overrides and compliance follow membership
  • PR: #4527
• fix(mobile): stop sending iOS responders to a Critical Alerts switch iOS is not showing
  • PR: #4516
• Every role does what its description says: billing roles, Runbook Member, owner emails
  • PR: #4528
• A change or a delete reaches only records its caller may read; a by-ID write that reaches nothing answers 404 or 422
  • PR: #4529