Security
- Workspace API tokens now carry a scope (read, deploy or ops) and an expiry (default one year), and every token-reachable route checks it.
- The agent signs every request with a timestamp and a one-time nonce on top of the body signature; old agents keep working until you require the new scheme.
- Login, two-factor and password-reset endpoints are rate-limited per address and per account; wrong codes count toward the lockout.