v41.0

- **Change**: Audit logs are the sixth Licensed Feature, in the Enterprise tier. The gate is on **recording** and on nothing else: without a key covering `audit_logs` nothing is written, and nothing is refused — the page, the export and the retention setting stay available and show whatever was recorded while a key covered it. A key that lapses past its 30-day grace stops recording and writes one marker entry, `licence.recordingStopped`, so the gap is never silent; installing a key writes `licence.recordingResumed`. The startup log says `audit_logs_recording=false` when this applies. Enterprise keys issued since v40 already carry `audit_logs`, so nothing has to be re-issued. The LICENSE file of v41 and later names the sixth capability; v40 and earlier are unchanged, as the licence promises. The retention purge never consults the licence: deleting data must not depend on it.

<img width="1161" height="532" alt="Capture d’écran 2026-09-17 à 10 19 32" src="https://github.com/user-attachments/assets/ce7e200b-ed6f-4fb1-b2ac-86c6686e7ccb" />

- **Improvement**: Every API response now carries an `X-Request-ID` header, generated when the client sent none and echoed when it did. It is stored on every audit entry, so an entry can be tied back to the application log line that served it.

- **Change**: The database schema moves to v41: an `audit_logs` table in the system database, with its append-only guard and retention functions. Workspace databases are untouched.

- **Improvement**: The AI email designer now knows which category a template belongs to and designs for it. A marketing template gets a footer carrying a visible unsubscribe link and a link to the notification centre, and the assistant keeps that footer when it rebuilds the layout; a transactional template gets neither, since an API send has no list to unsubscribe from; a double opt-in template gets its confirmation button. Its list of Liquid variables now says which ones are available for which kind of send, so it stops using a variable where the send would render it empty.

- **Fix**: The AI assistants no longer stop halfway through the job. The email designer would set the subject, leave the template empty, and only build it once you asked whether it had finished; the blog assistant could do the same with an article. It gets one response per message and never sees the result of a tool call, but nothing told it so, so it would set the subject, wait for a turn that never came, and leave the template empty until you asked whether it had finished. Both are now told to make every change in one response, to build the email or the article before writing the subject or the title so a long answer loses the commentary rather than the work, and to write the reply as ordinary text. That last point cannot be obeyed by Gemini, whose function-calling contract puts the answer after the tool results rather than alongside them, so a Gemini turn left a correctly built email under a collapsed Thinking block with no reply anywhere. When a response carries tool calls and no text, the assistants now send the results back for one more round purely so the model can write that reply; a model that already answered never triggers it and nothing extra is billed. An email or article that arrives incomplete, which is what a response cut off by the token limit looks like, now says so in the thread instead of failing silently.

- **Security**: Cleared the eleven open Dependabot alerts. `google.golang.org/grpc` moves to 1.83.2 in both Go modules, closing a crash in gRPC's xDS server on a request with no `:authority` or `Host` header; Notifuse runs no xDS server, but the module version is what a scanner matches on. The three front-ends move to `vitest` 4.1.11, because the arbitrary-file-read fix in `@vitest/mocker` has no 3.x release, and to `js-yaml` 4.3.2; both are build-time only, and `npm audit` is clean in all three.