v2.11.1

> [!NOTE]
> This release fixes authentication, vulnerability-management, and Docker compatibility issues.
> It also improves file-mode preservation, project navigation, notifications, and dashboard reliability.

## Authentication and notifications

- Align first-login password validation with the configured policy — `b71892d0902480a5e430bf4c10439d167508301c` (@kmendell)
- Prevent passkey MFA failures caused by reactive options — `95e5a3bc14706e69a9a366794d92706c55a53a7f` (#3926) (@kmendell)
- Preserve notification event subscriptions during partial settings updates and warn when none are subscribed — `817444abbd7984401e9f2e3ef59447e474f8d97b` (#3925) (@kmendell)

## Vulnerability management and Docker compatibility

- Fall back to `cpuset` for Trivy when the Docker host lacks CFS quota support — `41eae6334d8807d7fd7c159b73f157b28422e2a8` (#3910) (@kmendell)
- Allow vulnerability management to be disabled per environment — `4e432b30a69458c2077f9eac5ceb1a83709282b6` (#3914) (@kmendell)
- Pull pre-deploy runner images using configured registry credentials — `989e160ec544842d0db69ade182037cd2976b310` (#3918) (@kmendell)
- Fail image patching early when Docker lacks the containerd image store — `6fdcf37c2dba690a227d09e1bf5aaf3a3c632330` (#3928) (@kmendell)

## Projects and GitOps

- Preserve existing file modes when saving project and global environment files — `c92f3932cca1597c3d3fe3484b3d9a1e41289216` (#3919) (@kmendell)
- Preserve configured directory modes for GitOps directory-sync project roots — `31081659de472c06a639bd53e1615dff5077b5ac` (#3920) (@kmendell)
- Treat identity bind mounts as mapped when re-resolving escaped relative Compose paths — `7b19b854ace736bedafd0a632e8cb54f3420696a` (#3924) (@kmendell)
- Sort projects by live status instead of the stale persisted status — `0b594d1fd17c50285d9e7956f7bc8a488200c27b` (#3923) (@kmendell)

## Interface and dashboard

- Keep the environment detail page stable when navigating back to the list — `73d478211ebe090dc5afe38c098361e2b5770472` (#3921) (@kmendell)
- Prevent the project log panel from recursing on the viewer stop callback — `e8cc329c1042b896669ae091d64e6a8cbd15bf0f` (#3927) (@kmendell)
- End dashboard statistics loading on stream failure and retry on refresh — `16b7b59d5e6442bd8d2e0181356fb8f5d6488ebc` (#3930) (@kmendell)