Stamp official Docker builds with a low-cardinality provenance marker and report build_provenance/image_modified in anonymous telemetry. Local and fork builds default to custom, while official GitHub/GitLab release paths mark images as official.
Keep one-off device top-ups scoped to the active subscription term and move device renewal into subscription checkout.
Carry HWID renewal metadata through provider callbacks and webhooks, including YooKassa saved-card flows.
Add admin extension controls, docs, demo data, and regression coverage.
3252a8
BADtochka