Stamp official Docker builds with a low-cardinality provenance marker and report build_provenance/image_modified in anonymous telemetry. Local and fork builds default to custom, while official GitHub/GitLab release paths mark images as official.
Keep one-off device top-ups scoped to the active subscription term and move device renewal into subscription checkout.
Carry HWID renewal metadata through provider callbacks and webhooks, including YooKassa saved-card flows.
Add admin extension controls, docs, demo data, and regression coverage.
Add a broadcast audience for users who registered but never had any subscription or trial (no Subscription rows at all), backed by a new get_user_ids_without_any_subscription DAL helper and a 'never' target in the webapp broadcast route.
Add GET /api/admin/broadcast/audience-counts so the audience dropdown shows the recipient count next to each option, with graceful fallback when counts are unavailable.
3252a8
BADtochka