v0.10.6.2

## v0.10.6.2

`v0.10.6.2` is the corrective patch for the published `v0.10.6.1` release. It is **v0.10.6.1 plus a small regression-fix layer**, not a new feature release.

`v0.10.6.1` remains the validated base release. This patch fixes the deployment/browser regressions discovered after publication.

### Fixed since v0.10.6.1

- Dashboard `/api/config` now returns browser-reachable API/WebSocket URLs as the runtime SSOT instead of leaking internal DNS or localhost.
- Dashboard browser/VNC view now opens through the runtime gateway URL instead of raw same-origin `/b` paths.
- Gateway VNC CSP allows same public host, different-port dashboard embedding while preserving cross-host denial.
- Lite `make up` now persists `/var/lib/vexa/recordings` so replacing the Lite container does not erase local recording artifacts.
- OSS `VERSION` and Helm chart identity are bumped to `0.10.6.2`.

### Validation before public release

- PR #348 merged into `main`; GitHub CI green.
- `npm test` in `services/dashboard`: 38 passed.
- Dashboard lint on changed files: 0 errors, existing warnings only.
- Dashboard SSOT static guard: pass.
- Lite recording persistence static guard: pass.
- Browser-view script syntax checks: pass.
- Meeting API CSP tests: 3 passed.

### DockerHub

Before this release, DockerHub `latest` and `dev` still pointed to the validated immutable `0.10.6.1-20051411` image set. The `0.10.6.2-*` image set is being built and validated after this GitHub release; `latest` and `dev` move only after validation.

### Caveats

- Zoom Web automation/admission caveats from `v0.10.6.1` remain unchanged.
- Production rollout is separate from this OSS public release and requires production canary/sign.