release.2026-09-25T09-38-50Z.3268

## Feature Updates
- OAuth apps can send in-app notifications with user consent. Users can mute individual apps, and revoking authorization stops their notifications.
- OAuth apps can request access to paid-plan and active self-hosted license information. Consent is required for newly requested permissions, so forum users may need to sign in or authorize again for badges and notifications to work.
- Audit logs now cover more security and administration actions, including membership and role changes, sign-in failures, account changes, and OAuth app activity.
- Password-protected shares now generate a password when protection is enabled. Share owners can edit or regenerate it in the share panel and copy the link and password together. For artifact shares, the password is masked after the panel is reopened; change it to copy a usable password again.
- App Builder recognizes GitHub-linked repositories without requiring a separate personal authorization and offers a direct “Merge on GitHub” option for sync conflicts.
- Scrape triggers now reserve estimated credits before starting, use the latest balance, and release reserved credits when setup or a job fails. The public scrape parameter `limit` is now `limitPerInput`; integrations, CLI usage, and agent tools must update.

## Bug Fixes & Improvements
- OAuth connection popups now show authorization progress and confirm success before closing. Failed or declined requests remain visible with a reason and Close button. The popup also respects dark mode and reduced-motion preferences.
- Editing AI field prompts with blank lines, Backspace, or arrow keys no longer turns referenced field tags into plain text.
- Paid-space information shared with authorized OAuth apps now follows organization and space billing rules more accurately.
- Notification delivery has been strengthened so users receive only their own notifications.
- Deactivated accounts are now consistently prevented from continuing sessions, AI usage, app generation, and background work. Users must sign in again after reactivation.