v2.5.7 – v2.5.15 — 2026-07-04

• chore(security): bump Go toolchain to 1.26.4 (std-lib security patches)
• fix(backup): new backups use the admin default storage instead of hardcoded "local"
• fix(migration): system idempotency — re-runs skip "already exists" cleanly
• fix(migration): 502 abort, PHP fallback, auto package, customer idempotency, masking
• fix(migration): site 500 (missing sudo -> runuser) + mailbox/DB/forwarder visible in the panel
• fix(agent): fix nginx -t log-dir cascade + FPM socket wait after per-customer migration
• fix(update): GUI update banner didn't appear on non-English locale (LC_ALL=C)
• chore(locale): force LC_ALL=C in the agent install script (locale audit completion)
• fix(backup): "tls: bad record MAC" — separate HTTP transports for short/long
• feat(backup): real FTPS backup via restic+rclone
• feat(ip): block IP addresses for hosting (hosting_blocked)
• feat(login): claim "Web hosting management. Simplified." + link to enconf.com
• fix(backup): real FTPS connection test + rclone as a dependency (install+update)