[Owlbay]

摘要 / Summary

发版 0.12.0，与 Armadra、armadra-agent 统一版本。本 PR 只改版本号与更新记录；合并与打标签由维护者决定。
Release 0.12.0, unified with Armadra and armadra-agent. This PR only bumps versions and the changelog; merging and tagging are up to the maintainer.

• release：cloud 各包（11 个 package.json，apps/cloud 已随 [Feature] 删除已被 Go 取代的 TypeScript 控制面 apps/cloud / Remove the TypeScript control plane apps/cloud replaced by Go #177 删除）与协议包 @armadra/platform-protocol 升到 0.12.0；两份 OpenAPI 的 info.version 由 pnpm contract:generate 重新生成；Workers 中继 /health 测试里的版本跟上。协议仍是 1.4，PROTOCOL_VERSION 与两个 MIN_CORE_VERSION_* 不动。0.11.0 之后的第三方登录补充（能力位 auth.oauth.github / auth.oauth.google、auth.register 等错误表补 forbidden、auth.oauthFinish 加 registrations_paused 且会话分支多可选 csrfToken）都是只加不改，meta.ts 的说明记为随协议包 0.12.0 发布（没有新 procedure，所以没有新的 since 常量）；契约 §29 的「协议包下一版起」改为「协议包 0.12.0 起」。go generate 后 Go 生成物无变化。
  All 11 cloud package.json files (apps/cloud was removed in [Feature] 删除已被 Go 取代的 TypeScript 控制面 apps/cloud / Remove the TypeScript control plane apps/cloud replaced by Go #177) and @armadra/platform-protocol move to 0.12.0; both OpenAPI versions regenerated with pnpm contract:generate; the Workers /health test follows. Protocol stays 1.4; PROTOCOL_VERSION and both MIN_CORE_VERSION_* are untouched. The third-party sign-in supplements since 0.11.0 (capability bits auth.oauth.github / google, forbidden in the register error tables, registrations_paused and an optional csrfToken on auth.oauthFinish) are additive-only; meta.ts records them as shipping with protocol package 0.12.0 (no new procedures, hence no new since constant), and contract §29 changes "next protocol package" to "protocol package 0.12.0". No Go generated changes.
• build(deploy)：deploy/compat.json 的 web 0.11.0 → 0.12.0。release.yml 用它作 armadra-cloud 镜像的 WEB_IMAGE（armadra-server:<web>），所以 Armadra v0.12.0 必须先于本仓标签发布。protocol 不变。
  web in deploy/compat.json goes 0.11.0 → 0.12.0. release.yml uses it as WEB_IMAGE (armadra-server:<web>), so Armadra v0.12.0 must be released before this repository's tag. protocol is unchanged.
• docs(changelog)：Unreleased 改为 0.12.0（2026-11-02），「变更」开头加中英发版概要（统一版本、第三方登录与控制台回跳路由修复、Workers 中继撤销缓存修复、可选推送中继）与不兼容 / 部署注意（迁移 0011、OAuth 变量与 secret、PASSWORD_AUTH、--profile push 前提等）；小节顺序对齐 0.11.0（新增、变更、修复、移除）。
  Unreleased becomes 0.12.0 (2026-11-02); a bilingual release summary and incompatibility / deployment notes are added at the top of Changed; section order now matches 0.11.0.

本地检查 / Local checks

私有仓库 Actions 额度不可用，CI 不会跑，以下为本地结果（无 PostgreSQL / Redis / mailpit 容器，依赖它们的测试按仓库约定跳过）：
Actions budget is unavailable, so CI will not run; local results (no PostgreSQL / Redis / mailpit containers, tests that need them skip as the repo specifies):

• pnpm install --frozen-lockfile：通过 / ok
• pnpm check（libs:build、format、lint、typecheck、repo:check、contract:check、protocol:check、ci:workflows、notices:check）：通过 / ok
• pnpm go:check（gofmt、vet、staticcheck、go test -race、生成物新鲜度）：通过 / ok
• pnpm repo:test：59 / 59
• pnpm test：全部通过（协议包 368、relay-kernel 80、control-core 66、relay-runtime-workers 61、control-store-sqlite 49 等）/ all pass
• 未跑 / not run：pnpm test:integration、pnpm images:build、pnpm e2e。

发版时还要做 / Release steps for the maintainer

1. 先发 Armadra v0.12.0，确认 ghcr.io/ama-link/armadra-server:0.12.0 与 ghcr.io/ama-link/armadra-push-relay:0.12.0 已推送（不存在时本仓 release.yml 构建 cloud 镜像会失败，推送中继服务也拉取不到）。
   Release Armadra v0.12.0 first and make sure armadra-server:0.12.0 and armadra-push-relay:0.12.0 are pushed (the cloud image build fails otherwise, and the push-relay service cannot be pulled).
2. 合并本 PR（merge commit），在合并提交上推 v0.12.0 标签；release.yml 构建、冒烟并推送镜像，用 CHANGELOG 的 0.12.0 一节建 Release。
   Merge (merge commit), push tag v0.12.0; release.yml builds, smoke-tests and pushes the images and creates the Release from the 0.12.0 changelog section.
3. 协议包如需发 npm（pnpm protocol:pack），由维护者执行。
   Publishing the protocol package, if wanted, is a maintainer step.
4. SaaS 升级：PostgreSQL 迁移 0011 前先备份；已有部署先重跑 sh init-secrets.sh 补 OAuth 的两个 secret 文件（compose 已声明）；第三方登录与 --profile push 都是可选的，不配则行为不变。
   SaaS upgrade: back up before migration 0011; existing deployments re-run sh init-secrets.sh for the two OAuth secret files (declared in compose); third-party sign-in and --profile push are optional and change nothing if left off.

Refs #60
Refs #184
Refs #187