v4.9.1

See the assets to download this version and install.

## What's Changed
* fix(security): serve persona avatars as inert images and scope token refresh to its transport (#15646) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15650
* fix(gmail): the slim listing reads every page of every user (#15649) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15652
* feat(sync): gap-fill first-party chat models litellm lists before models.dev (#15596) to release v4.9 by @devin-ai-integration[bot] in https://github.com/onyx-dot-app/onyx/pull/15676
* fix(llm): mark endpoint-less OpenRouter routers unbounded, emit no output limit (#15660) to release v4.9 by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15681
* fix(sharepoint): look up folder permissions without long URL paths (#15736) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15739
* fix(llm): harden vendored model catalog against upstream data pathologies (#15682) to release v4.9 by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15750
* fix(permissions): read stored rows whose document metadata is null (#15762) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15763
* feat(llm): prefer live model catalog from main, vendored table as offline floor (#15684) to release v4.9 by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15751
* fix(slack): skip channels the bot cannot join instead of failing the run (#15897) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15932
* chore(hotfix): cherry-pick 6 CVE Alerts commits to release v4.9 by @devin-ai-integration[bot] in https://github.com/onyx-dot-app/onyx/pull/15936
* feat(craft): show a Business upsell for Craft on Community Edition (v4.9) by @devin-ai-integration[bot] in https://github.com/onyx-dot-app/onyx/pull/15902


**Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.9.0...v4.9.1