Merge branch 'DEV-153-login-hardening'

docs: use fictional example.org addresses in readme and tests

docs: describe 1.3.0 in readme and changelog

feat(login): add max length, optional login-free messages and nfc handling

build: test on laravel 12 and 13, add larastan, lint script and ci

Merge branch 'DEV-153-markup-validation'

docs: describe 1.2.0 in readme and changelog

feat(markup): validate markup, add categories list and report --strict

build: test on laravel 12 and 13, add larastan, lint script and ci

Merge branch 'DEV-153-jwks-hardening'

docs: use fictional example.org addresses in readme and tests

docs: describe 1.3.0 in readme and changelog

feat(jwks): bound jwks requests and fail fast while keycloak is down

build: test on laravel 12 and 13, add larastan, lint script and ci

Merge branch 'DEV-153-secure-defaults'

docs: use fictional example.org addresses in readme and tests

docs: describe 1.1.0 in readme and changelog

feat(security): require tls, drop org defaults and make models read-only

build: test on laravel 12 and 13, add larastan, lint script and ci

Merge branch 'DEV-153-failure-mode'

docs: use fictional example.org addresses in readme and tests

docs: describe 1.3.0 in readme and changelog

feat(failure): add report mode, file permission and channel level check

build: test on laravel 12 and 13, add larastan, lint script and ci

Merge branch 'DEV-153-envelope-hardening'

feat(rendering): add json_paths for clients without accept header

docs: describe 1.3.0 in readme and changelog

feat(errors): add api exception, conflict transport, status table, headers, pagination shapes and schema

docs: use fictional example.org addresses in readme and tests

docs(changelog): date the 1.2.0 release

Merge branch 'fix/review-2026-09'

docs(readme): state that the package targets Russian names

docs(changelog): describe the review fixes as 1.2.0

feat(config): reserve abuse, security and mailer-daemon logins

docs(changelog): date the 1.1.0 release

Merge branch 'fix/review-2026-09'

build: require PHP ^8.4 and add CHANGELOG

fix(report): escape the pipe character in markdown cells

feat(report): take pdn:report table headers from localization files

docs(changelog): date the 1.2.0 release

Merge branch 'fix/review-2026-09'

fix(user): make email() safe for a non-string claim

docs(changelog): describe the review fixes as 1.2.0

test(jwks): cover a realistic Keycloak key set with an enc key