chore(main): release 2.37.0

[github-actions]

🤖 I have created a release beep boop

2.37.0 (2026-07-01)

Features

• auth: short-lived scoped stream tokens for image/SSE URLs (1b5e8e4)
• fields: add generic action_button settings field type (b4ec1e2)
• gdrive: confirm drive removal and optionally delete local folder + cache rows (5182971)
• instances: support renaming an instance end to end (49c65ed)
• posters: unified, readable CL2K/MM2K provenance stamp (9ff36a6)
• stats: count Sonarr at the episode level (shows/seasons as context) (00044c8)
• stats: order Artist above Album in By type (dc9d94e)
• stats: pair By type with By instance, consistent card borders (df45aa7)
• stats: regroup Library Statistics by synced instance (e1853ac)
• stats: show Sonarr Series AND Episodes as separate cards (ac3fa0e)
• sync: background instance reconciliation from the Instances page (0618712)
• webhooks: banner when ingest endpoints are unauthenticated (8177c90)

Bug Fixes

• auth: keep the stream token warm + rebuild image URLs when it lands (ac0758b)
• backend correctness and reliability fixes (03191ea)
• config: split a shared-webhook notification destination by event (1908da5)
• data-loss: guard destructive poster/nohl/upload paths (274588c)
• docker: download rclone to its checksummed filename so sha256sum -c passes (10dddfa)
• fields: action_button ignores a stale result after its row changes (89b3586)
• frontend: cache invalidation, callbacks, and falsy-value bugs (5219923)
• frontend: FloatField 0-value, duplicates-resolve cache, instance keys (583bb7e)
• instances: case-insensitive source on rename + composite UI-state keys (079bdce)
• instances: disable redirects on SSRF-validated health/test probes (184ffd9)
• instances: don't clobber stored API key with the redacted placeholder (3878d05)
• instances: read sync_schedule from the nested section response (4d1666e)
• instances: resolve redacted API key by URL when renaming (837e23b)
• jobs: collapse a composite trigger to its readable base (876e854)
• jobs: humanize the job-type label (28967b8)
• logger: redact secrets in tracebacks, yaml OAuth tokens, and the Notifiarr key (05ef9df)
• modules: redact secrets in GET /api/modules/{name} (8dc024c)
• notify: stop redacted placeholder clobbering destination webhooks (b38a128)
• schedule: reject malformed schedule strings at the API (40e2233)
• security: fail closed on config error + warn on unauthenticated webhook ingest (23336ef)
• security: fail-closed SSRF guard, key-exfil + redirect guards, auth-section write block (012ce45)
• stats: derive Lidarr has_content from track files for accurate library stats (28dfaff)
• stats: exclude unmonitored-artist albums from Lidarr Missing (a4e6eab)
• stats: normalize instance source case (title-cased source broke labels/order/freshness) (3b4165e)
• stats: normalize media_cache.source at the write boundary (5236831)
• stats: read the matched_posters_stats key so Top contributors renders (ae30605)
• stats: release-gate Missing + add Upcoming; drop Statistics refresh (a46a416)
• unmatched: move recently-matched provenance stamp to the poster top-left (3f04e25)
• webhooks: stop clobbering per-season has_content/monitored on upsert (5ab982c)
• worker: scope startup job reset to the worker's own partition (982a7b1)

Performance

• instances: drop the live wanted/missing call from the Instances page (cc5a075)

Refactoring

• instances: drop the service-type badge from instance rows (838dab5)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v2.37.0

🌻