v2.10.0

> [!NOTE]
> This release adds selective system restores, scheduled volume backups, Convert to Compose, direct image patching, Apple push notifications, and ML-DSA-87 signing for authentication and edge mTLS.
> It also improves upgrade reliability, image update discovery, project logs, Swarm access, backup downloads, and UI performance.

## Backups and recovery

- Add selective system restores and harden recovery — `874134cfedc2e8ae44e6f0cd7e957e87bc760988` (#3708) (@neurekadev)
- Add system-managed volume backup scheduling — `53a959f93e26193c6c9ac4bb4053555f18e8b2ff` (#3737) (@neurekadev)
- Reduce S3 backup download amplification — `538350af6c72d0e6d80164f6aacb3b8dd02cd1bd` (#3773) (@kmendell)

## Containers, images, and projects

- Add experimental Convert to Compose for running containers — `9aef34e4ea703cbee29d31a4338413018ce54f34` (#3746) (@kmendell)
- Add direct Copacetic image patching — `3617720518f0bdfc4282a7b5844508f3b7da60ec` (#3744) (@kmendell)
- Restrict Copa patches to OS-level issues — `e95c55326a59a615993113e0ee809df734a40b0a` (@kmendell)
- Store raw Trivy reports in the database and fix patch-target pagination — `53e7e82715bfebd9ed0d1a27dc0b777d0bbd68b0` (@kmendell)
- Honor UI container exclusions during image update discovery — `b9b2092c0e36d3eaba66335e003b7ecd5e858540` (#3763) (@kmendell)
- Stop checking Arcane-built local images against registries — `8d10b7db2d34aefa44f0f9a684f3b84b2ae355d7` (@kmendell)
- Query image update information directly instead of caching it per container listing — `509c6e81babef8c3ac0b4bf9c418c1d3115c50a8` (@kmendell)
- Resolve upgrade target images for blank-target self-upgrades — `8bbd157a2963874998c481487d132f460cb15b1c` (#3772) (@kmendell)
- Honor `COMPOSE_FILE` and other predefined environment variables in projects — `6e1dbb2d22858014970f3b235b73acea0fc70ad5` (#3709) (@kmendell)
- Forward registry authentication when deploying Swarm stacks from Git Sync or source edits — `1570a1da7a00e20012dcdf3d5496e2d9f39f732f` (#3787) (@elfensky)

## Reliability and operations

- Return HTTP 200 from the environment health check — `6b46c36a237328fc0728ac8fd02e8bc79a149986` (@kmendell)
- Write workspace files using the volume’s runtime identity instead of root — `f4958ae8c8318bd921ef5be4ae9a6436309b0cd5` (#3745) (@kmendell)
- Match Docker CLI memory accounting for cgroup v1 containers — `4c479f1c5b01ae6932e2de2ad91ca79aa6874edc` (@kmendell)
- Purge leftover Git clone scratch directories — `d57d18f1136c1e518be656615f6e2df01d777e34` (#3771) (@kmendell)
- Preserve stderr streams and Docker timestamps in project logs — `cac8a9090baea3b44aa2868d195cd21c3dcf62f0` (#3770) (@kmendell)
- Allow the Viewer role to browse Swarm resources — `3f205dea94fa6d40189cf80eec665e39c5131e60` (#3779) (@kmendell)
- Trigger agent self-upgrades asynchronously and pass the manager’s resolved target version — `d857910d9b08f96e7739c679415b18fd192a01b4` (#3786) (@kmendell)
- Serialize explicit empty values in partial-update DTOs with `omitzero` — `24592561d9154da35d7fecd380e12c50e3c5783a` (@kmendell)

## Authentication and notifications

- Add native Apple push notifications for the iOS app — `4b1abefec6b9b93ea331e1259e061c6862025a11` (#3783) (@kmendell)
- Sign and verify sessions, OIDC, passkeys, and edge mTLS with ML-DSA-87 — `2993fd316d41fafc110476370870a49b9202969c` (#3785) (@kmendell)
- Accept display names in email notification From addresses — `034e7e7efd4e756f0c3145099f24f2afe0bc7596` (#3776) (@ohOgil)

## User interface

- Improve table-scrolling performance across all views — `1243d8e0bafdc110b8443ef710d999e5104ce632` (@kmendell)
- Keep dialog widths within the content area — `5e7acb61d3bb6ef4bc60a80266c424f1d40d02c2` (@kmendell)
- Move frontend files into a more maintainable structure — `938882a174322a1bbc6fe50fe926a4c61820797b` (@kmendell)

## Dependencies

- Bump `github.com/aquasecurity/trivy` from 0.69.3 to 0.72.0 in `/backend` — `29784fead298d740fb07db2754d53ff55e3bb9c4` (#3748) (@dependabot[bot])
- Bump `github.com/sirupsen/logrus` from 1.10.0 to 1.10.1 in `/backend` — `be4220fa2cc44c348177de5c39354b716a517413` (#3753) (@dependabot[bot])
- Bump `github.com/quay/claircore` from 1.5.52 to 1.5.53 in `/backend` — `611b5d7ff298ccd51b0675874354282aa117356c` (#3747) (@dependabot[bot])
- Bump `github.com/samber/hot` from 0.13.0 to 0.13.1 in `/backend` — `cecdb777ec0f3487ab442f2bd1a45dc1120f0564` (#3754) (@dependabot[bot])
- Bump `charm.land/bubbles/v2` from 2.2.0 to 2.2.1 in `/cli` — `b631dd67c34ef642c3bb177ad3d9df09c0974b0d` (#3752) (@dependabot[bot])
- Bump `@tanstack/svelte-query` from 6.1.39 to 6.1.43 — `55762896904d9453f2c2cbeb26645b6e0f6818a2` (#3761) (@dependabot[bot])
- Bump `github.com/google/go-containerregistry` from 0.21.9 to 0.22.0 in `/backend` — `3c0aac7c557ace8a15ffbd60dd6dc4448ec43a93` (#3755) (@dependabot[bot])
- Bump `marked` from 18.0.10 to 18.0.11 — `201a3ff183a0f07e342398d0b1b12ca3847777a5` (#3759) (@dependabot[bot])

## Refactoring

- Use generics to eliminate redundant logic — `671ebef57234c40acba287925c5ee6ac9efdd399` (#3683) (@kmendell)
- Migrate JWT and JWKS handling to jwx v4 — `45b063a074f521f45591f58c7b1d89b4395dc267` (#3790) (@kmendell)