v2.14.0

> [!NOTE]
> This release adds bulk actions for vulnerability findings, a redesigned risk-based security view, container process visibility, and search in the template selector.
> It also improves update workflows, Compose handling, backups, Easy Join, and activity processing while resolving several access and configuration issues.

## Security and vulnerability management

- Added bulk ignore and restore actions for vulnerability findings — `8dd49f1ac48b6dc1a17c960e08287338934eb33f` (#4158) (@kmendell)
- Redesigned the risk-based security view — `cac682df3161e4228b5217fc3c9361700485c280` (#4204) (@kmendell)
- Improved the risk score model — `0238e1414138788e1b674b1ae9d1ffc5b65adc38` (#4205) (@kmendell)
- Fixed environment-admin resource pages requesting globally protected data — `91825a6865e1e3a5a5913c0dfb938dc4093dbfe6` (#4151) (@kmendell)
- Accepted Safari’s unrequested `appid=false` value during passkey assertions — `a7db1aeafd3aff1e5e3161780dd37d117ac0084a` (#4208) (@kmendell)

## Containers, projects, and updates

- Added a container processes tab — `bbc70f7d6007b3532c1bc103e30e1cb9222ef6fe` (#4187) (@kmendell)
- Routed container updates through the activity system — `2e35dfda39ed51e692fb4b00c944fd1ba6ceb6e5` (#4167) (@kmendell)
- Resolved pending update status consistently across containers, projects, and the dashboard — `aaac10a0d5e1105edfa01a0708f4cdbaf6e96375` (#4189) (@kmendell)
- Preserved Compose formatting when applying tag updates — `b9d64a9f116f700f64fa30ebc04d5816e3174f20` (#4172) (@kmendell)
- Recreated namespace dependents when updating Compose services — `33216715407a75a2b2ce499d228dab68a847ac87` (#4179) (@kmendell)
- Preserved pinned Compose tags unless enabled by the updater strategy — `72532defe45ac340d07aaf01b6d6a9e393972d87` (#4180) (@kmendell)
- Continued checking for updates for containers excluded from automatic updates — `4eeb7d43d3c4aea469803ea6f94645ab94f8de1c` (#4181) (@kmendell)
- Logged project updates during Git sync only when content changed — `439aee51db0e19769928e68454d610f2cb53cfcd` (#4206) (@kmendell)
- Skipped symlinked external bind sources when preparing project updates — `bcaa9d447b5aa044c60a9aa657179b8000dfa2d7` (#4207) (@kmendell)
- Kept the project Save action mounted to maintain a stable toolbar layout — `dd37ce953c0e673776f7a843fabff612fa928147` (#4157) (@kmendell)

## Environments, backups, and configuration

- Allowed token re-entry when changing an agent API URL — `af4dab5f00980e34c3870deffae636eb4a498793` (#4160) (@kmendell)
- Allowed deleting backup records for missing snapshots — `b30e617cfa403d91fd6306dfe88bdd2133a8dcb6` (#4161) (@kmendell)
- Surfaced Docker join errors and added a manager-address override to Easy Join — `e2312137c99ff400f8473265780816d6bf9cab3f` (#4191) (@kmendell)
- Allowed dots and hyphens in `.env` variable names — `144d7acced1ba23e0661148ce29b3db107732b58` (#4199) (@DominikZublasing)
- Added search to the template selection dialog — `4bbcbfea6274e149a57daa386a57543df688f380` (#4183) (@kmendell)
- Forwarded proxy configuration to Trivy scan containers — `85b9b16baa0d79edc7ab3d01df98dcd3d811a1d1` (#4168) (@kmendell)

## Activity processing

- Isolated activity subscriber payloads to prevent concurrent writes — `9fc00866b9107366824b91cdd887de54c8b089d6` (#4159) (@kmendell)