Stable v2.10.86

Features

• Add per-site application-layer flood protection (nginx limit_req/limit_conn)
• Add Cloudflare Turnstile progressive-friction CAPTCHA on login
• Non-blocking 2FA recommendation banner regardless of force_2fa policy

Improvements

• Render ModSecurity WAF include in Apache-proxy vhosts
• Extend flood protection to Apache-proxy vhosts, shrink per-site zone size
• Frame untrusted third-party text in tool results
• Address Turnstile CAPTCHA review findings
• Fix 4 bugs found during live E2E test against real ClouDNS API
• Bump x/net and go directive in clouddns-sync to clear govulncheck gate