v2.16.0

> [!NOTE]
> This release adds OpenTelemetry support, a redesigned multiplexed edge tunnel, and useful CLI previews and self-update tooling. It also improves container and project workflows while fixing issues across authorization, databases, and connectivity.

### Interface and container workflows
- Prevent duplicate role assignments from causing a 500 in the user editor. (#4332; @DominikZublasing)
- Recognize JSON in container logs. (20c2438; @kmendell)
- Virtualize large tables, confirm before loading all vulnerabilities, and keep table height within the viewport. (#4340; 011d2cc; 7d8b207; @kmendell)
- Reuse unclaimed project directories when creating projects. (#4343; b80f1bc; @kmendell)
- Remember the last-used shell for each Compose service. (#4348; 8176ee5; @kmendell)
- Confirm before bulk-updating containers or projects. (#4347; f5672c9; @kmendell)
- Close editor tabs with a middle-click and save projects with Ctrl/Cmd+S. (#4333; a7f16c9; @DominikZublasing)
- Support `icon_url` in remote template registries. (#4350; a78fc13; @kmendell)
- Add development/beta version branding. (2158fe7; @kmendell)
- Fix action button overflow and make menus more compact. (94b1658; @kmendell)

### Jobs, storage, and reliability
- Enforce SQLite foreign keys and remove orphaned authorization records. (#4339; 33bdd33; @kmendell)
- Allow schedules to be updated for disabled jobs. (e7317f0; @kmendell)
- Prune local backup repositories daily to free space from deleted backup data. (#4235; 2ecc763; @GiulioSavini)
- Migrate jobs to fan-out workflows. (#4356; 1cb7577; @kmendell)
- Stop the app if the Francis host fails during bootstrap. (#4371; e9b8ee1; @kmendell)
- Keep SQLite tuning on the Francis actor store and stop syncing on commit. (#4372; a4376c5; @kmendell)

### Edge, security, and observability
- Stream edge responses, pool proxy connections, and clean up the edge package. (#4354; df80491; @kmendell)
- Mark direct agents online when the dashboard can reach them. (8b3756c; @kmendell)
- Add OpenTelemetry metrics, traces, and logs. (#4367; f3bfc28; @kmendell)
- Report environment counts only from the manager. (17c223a; @kmendell)
- Add a multiplexed edge tunnel and redesigned connection view. (#4375; 70c2954; @kmendell)
- Extract client IPs only from configured `TRUSTED_PROXIES`. (#4351; ceab1a7; @kmendell)
- Skip API-path auto-login checks when auto-login is disabled. (64eb4d3; @kmendell)
- Require a verified email before merging OIDC accounts. (#4381; bc6547f; @kmendell)
- Gate actions on variable permissions rather than `templates:update`. (#4382; ccb06ea; @kmendell)
- Prevent stale user writes from overwriting profiles. (ae7641d; @kmendell)
- Match Trivy scans by layer diff IDs. (ebb5a1f; @kmendell)
- Allow self-upgrade helpers through the Wollomatic socket proxy. (#4383; 9e2e9f4; @kmendell)

### CLI and integrations
- Add an all-environments preview to the CLI and UI. (c8ec324; 298c8cf; @kmendell)
- Refactor CLI commands around constructors, generic helpers, and shared types. (0d07bea; @kmendell)
- Display JSON stream output and correctly formatted configuration in the CLI. (ace2c8d; e8b83db; @kmendell)
- Store CLI authentication settings in a separate `auth.json` file. (#4379; 517cd55; @kmendell)
- Add a Sigstore-verified self-update preview to the CLI. (#4380; 2a7673a; @kmendell)
- Let ECR registries use the AWS default credential chain. (#4357; fc18c60; @Guik)
- Improve ntfy notification formatting. (#4336; 1899f0b; @maghuro)
- Standardize on `github.com/docker/go-units`. (#4377; aafcfb4; @kmendell)
- Disable Gravatar by default and make it configurable. (#4349; 75996ec; @kmendell)