v2.16.1

> [!NOTE]
> This release fixes backup handling across older Docker daemons and S3, improves health and scheduler reliability, and reduces live-stats rendering costs.

### Backups and storage
- Bind-mount volume subpaths when backing up on daemons older than API 1.45. (#4399) @kmendell
- Send S3 request checksums only when required, improving GCS compatibility. (#4401) @kmendell
- Write S3-only system backups directly to S3 without a local repository. (#4400) @kmendell
- Include the absolute path and UID in project-directory permission errors. (#4404) @kmendell

### Containers, projects, and scheduling
- Report Francis as down when its host exits and extend its health-check deadline. (#4402) @kmendell
- Exclude Swarm task containers from the standalone-container filter. (#4405) @kmendell
- Preserve build image references when Compose fails to load, and document the update-check label. (#4406) @kmendell
- Reset invalid cron settings to defaults at startup. (#4425) @kmendell
- Clear caches when refreshing a workspace. (#4427) @kmendell
- Allow manual updates for services with the updater disabled. (#4430) @kmendell

### Registries, updates, and access
- Retry digest lookups after TLS handshake timeouts. (#4428) @kmendell
- Remove the stale digest name left behind when a frozen pull is tagged. (#4409) @kmendell
- Stop resending image-update push notifications on every poll. (`cd7c39cfcb6c364751d4b55bab887c11b5ebd859`) @kmendell
- Restrict SSH host-key algorithms to entries in `known_hosts`. (#4403) @kmendell
- Match user email lookups without regard to case. (#4429) @kmendell

### Interface and performance
- Fix virtualized table cells being clipped by locking column widths in pixels. (#4407) @kmendell
- Localize settings backup cards and role presets, and prevent long labels from overflowing. (#4408) @kmendell
- Batch live stats by environment to reduce table rendering costs. (`3330f4e0f53bb152cc4720be8ae724cdb1bd8cbb`) @kmendell

### Maintenance
- Merge all-environment resource lists on the server. (#4419) @kmendell
- Simplify registry helpers with composite literals and inline helpers. (`00daf4441a6724cc9ff991f2927d73dcd61f4b89`) @kmendell
- Simplify project construction, merge duplicates, and remove dependency-injection nil checks. (`a432f2c80c44017d1cba7042cf971bb03a63c410`) @kmendell
- Simplify system construction and remove dependency-injection nil checks and mappers. (`cdfe49e8cbe0110e60e582aba3a4ce93c8fdb962`) @kmendell