- Added read‑only built‑in RBAC role and support for custom OIDC JWKS URLs
- Fixed multiple stability issues: segment file reading, viewer‑group cleanup, backup cancellation handling, BMW filtered search and hybrid index panic
- Improved RBAC/audit logging with new tests and resources aggregator