Stable v2.8.7

New: admin Single Sign-On via OpenID Connect. Panel administrators can now sign in through an external identity provider — Keycloak, Authentik, Azure AD / Entra ID, Google Workspace, Auth0 and any other standards-compliant OIDC provider. It's discovery-based, so a single integration covers every provider: enter the issuer URL and client credentials under System → Single Sign-On, and a Single-Sign-On button appears on the login page. Access can be restricted by e-mail domain, address or IdP group, and local password login always stays available as a break-glass path, so a misconfigured provider can never lock you out. Admin-only by design.

Backup reliability overhaul. A series of fixes makes backups robust on slow or connection-limited backends — especially FTP targets, where a slow retention prune could previously wedge an entire schedule:

• feat(auth): admin single sign-on via OpenID Connect (Keycloak, Azure AD, Google, …)
• fix(backup): recover from stale restic locks so a failed run can't wedge all future backups
• fix(backup): serialize restic ops per FTP host to avoid 530 connection-limit failures
• fix(backup): prune only weekly per repo instead of after every backup
• fix(backup): deleting a single snapshot no longer blocks on prune
• fix(backup): deleting a snapshot removes its row from the list immediately