v2.10.2

> [!NOTE]
> This release adds performance improvements across authentication, Docker calls, scheduled scans, project loading, and CVE serving. It also fixes container shell handling, scheduler overlap, image digest display, authentication flows, agent reconnection, and several UI and integration issues.

## Fixes

- Surface container shell close reasons and disable WebSocket compression — `30e1bb590a34d9aeded744a71d39e8709b3b7b33`, `b9b8c813f6d3735770f2bc1bf5c80b4967eb7e26` / #3814 (@kmendell)
- Skip overlapping scheduled cron job runs — `51cf6bb6a1049a01596a5933ddb2508de6938dea`, `5232b4d04bfb482ed9d3ec869f30ec2fee03ca30` / #3815 (@kmendell)
- Refactor image digest inspection logic — `d256fc2787efd18341d84e63e59e7cd38300e99d` / #3826 (@jdrouhard)
- Keep the first-login password dialog open and clear its flag after an admin password change — `6f90da73f3606e42e58a0f00c98208f5817c27c9` / #3831 (@kmendell)
- Allow the frontend to recover from stale chunks after a redeploy — `8c294a7316f3616a704edfec366f4adccd91a577` (@kmendell)
- Keep edge agents on gRPC after a manager restart — `4febf6d0dcf64997b53cba7743d082b4c7550979` (@kmendell)
- Show digest-pinned image references — `5c0592994278ac9ab4600966dcdb460ecbef857b` / #3836 (@kmendell)
- Hide passkey login when no credentials are registered — `b7b568e1a6911bf1b8369de129af792fb0f23e4e` (@kmendell)
- Honor SSH usernames in Git repository URLs — `837fe10c92ddbb2391d7b13475d475a68f7fca2c` (@kmendell)
- Support host memory accounting for Docker inside LXC — `416e93a4be282a5d26025f9fd00f3ae56c70bb71` / #3846 (@kmendell)
- Load project digests automatically when entering the Updates page — `8d5eaeb9dda0072736eb67272de4d7d781d7472b` (@kmendell)
- Sort environments by name while placing the current selection first — `4e0f1dcfc074a4562b59ef03ee49dabbd68f40f5` (@kmendell)
- Rate-limit webhook triggers by token instead of client IP — `de1e978810a490fd7930a634bd4df765a50f65b2` / #3742 (@ohOgil)
- Run backups in an activity instead of locking the UI — `dd16fd942afaed4db4d63ad4fa787bce20251f8d` / #3847 (@kmendell)

## Performance

- Serve cached authentication token state — `65fcfa637919992c81b373396265455a1f08ae3c`, `5e8ecabd4f0c2aa3c3011baab6761dc13aabc96f` / #3816 (@kmendell)
- Route Docker daemon calls through singleflight callers — `64c2500b669f343451f2541a045b578e10ee172b` / #3818 (@kmendell)
- Share one stream producer across all clients — `db9878d01dccfed0406cee7c5e573a7f2c8637fe` / #3819 (@kmendell)
- Look up Copa targets by digest instead of issuing database queries — `ddcd50530759ed0b31d2f717e7d82a213bfd655d` / #3821 (@kmendell)
- Validate the projects metadata cache by file modification time and resolve entries in parallel — `0b44e8dd5e16131015e18c70601c79b1c2cad9a9` / #3823 (@kmendell)
- Serve the CVE list from a normalized table — `31a9896dfb052ece34d7ba4c14d8347b9ad8a8b5` / #3825 (@kmendell)
- Bound scheduled scans, skip unchanged images, and avoid remounting during navigation — `8299a56c5430f9a04ee132b15f58a9e46f810dc0` / #3829 (@kmendell)
- Dispatch notification providers concurrently — `767992dc34a4b98d35fb220425bf51ea9b123961` / #3820 (@kmendell)

## Improvements and refactoring

- Allow selecting registries for Arcane Tools and Trivy databases — `b85caceeef0ba5dd094ce1fcb82805acfd2a6445` / #3830 (@kmendell)
- Clean up duplicate HTTP client logic — `8a74c1b729e6bd0b02e1bcf17a824cc445cb2eb3` (@kmendell)

## Dependency updates

- Bump `react-email` from 6.9.2 to 6.9.3 — `0cbb2590792d935ff2c7a20468e91edc3b318304` (@dependabot[bot]); `8dd0210aec7303fa506cdf77e235804961107a7d` / #3806 (@kmendell)
- Update the `tanstack-table` group with two updates — `f58bc47404cbc61ca0c2a62a4d48436e5b2b5688` (@dependabot[bot]); `0a7ea50401c95aff42f90b94172b0c2f42ece4cb` / #3799 (@kmendell)
- Bump `ky` from 2.0.2 to 2.1.0 — `5700fb7f52a95e3e21ab0fce8d5a7e453cb0201c` (@dependabot[bot]); `ab3eaae5751c0abe8ae326b35b565b43f2ed678f` / #3802 (@kmendell)
- Bump `svelte` from 5.56.10 to 5.57.0 — `3db4f4a591fd43aff54d5d9ca679780f6d9c5e35` (@dependabot[bot]); `efb72f212b9795ecccfcf3b792a0e76dedebb1c6` / #3808 (@kmendell)
- Bump `@tanstack/svelte-query` from 6.1.43 to 6.1.48 — `917e6c267748da315f93855dadbea3444466f12c` (@dependabot[bot]); `242744189b8e1065be494d5cd25c8a97ecb511c0` / #3807 (@kmendell)
- Bump `pnpm` to v12.2.1 — `7d33837fd5a2d8bfd9617dabe7347f1ea06ca1c2` (@kmendell)
- Bump `@xyflow/svelte` from 1.6.3 to 1.6.5 — `1829e66194ca404bd8ff4b211e693a7d149ac184` / #3810 (@dependabot[bot])
- Bump `github.com/nicholas-fedor/shoutrrr` from 0.18.0 to 0.19.0 in `/backend` — `343dc2020f10c610f81bb5834bcc5b858377afbe` / #3840 (@dependabot[bot])
- Bump `golang.org/x/crypto` from 0.55.0 to 0.56.0 in `/backend` — `37226ae35749563489551c840ca2b1620e07e3e6` / #3844 (@dependabot[bot])
- Bump `github.com/coreos/go-oidc/v3` from 3.20.0 to 3.21.0 in `/backend` — `504e5b6dda7ea16bdab84eb6b72c1da47e90414d` / #3845 (@dependabot[bot])
- Bump `github.com/pressly/goose/v3` from 3.27.3 to 3.28.0 in `/backend` — `d6271ea3045682a063b516ea0f1d71fc2f7e4a64` / #3841 (@dependabot[bot])
- Bump `github.com/klauspost/compress` from 1.19.2 to 1.20.0 in `/backend` — `71d866fefdd79552afd4db123fd01cbd29199753` / #3843 (@dependabot[bot])
- Bump `github.com/mattn/go-runewidth` from 0.0.28 to 0.0.29 in `/cli` — `5137b5dcb4efe2e6107adc7d316af4ec9132f01b` / #3838 (@dependabot[bot])