🐛 Authenticate inbound Mailgun replies correctly

Use the webhook signing key and reject failed authentication cleanly. Fixes DANDELION-3B.

🐛 Allow cross-origin browser MCP clients

Disable transport DNS-rebinding Origin checks so public /mcp matches open CORS for web connectors.

♻️ Remove Render CLI from Cursor Docker image

Render MCP works on cloud now, so the CLI install is no longer needed.

✨ Log feedback request selection and send outcomes

♻️ Show Mailgun desktop/mobile/tablet click bins

✨ Track desktop vs phone on mailer link clicks

🏗️ Add gc and gp agent skills for commit/push workflows

✨ Filter stats orders by donation to Dandelion by default

♻️ Load CKEditor from GitHub and add small paragraph style

🐛 Warn on leave after editing WYSIWYG fields

♻️ Move PROMPT_LOG_LIMIT out of private scope

♻️ Remove unused gathering radio_scopes

♻️ Remove large commented-out code blocks

🐛 Prevent truncated OpenRouter responses

Remove the shared completion-token cap so reasoning models can finish their visible output.

📊 Log OpenRouter generations for diagnostics

Persist successful chat generations and expose them to administrators for troubleshooting.

⬆️ Bump loofah and rails-html-sanitizer for XSS fixes

🐛 Fix post-payment redirect URL JS escaping

HTML-escaped JSON quotes broke window.location assignment, so thank-you redirects never ran.

♻️ Transcribe WhatsApp audio via OpenRouter Parakeet

⬆️ Upgrade mcp gem to 1.1.0

Allow the production Host header under the new DNS-rebinding checks, and support DELETE on /mcp.

♻️ Bust event cache after AI tagging

Populate tag_names_cache and clear fragments so tags show up immediately instead of waiting for a stale cached page to expire.