PR

• Have you followed the contributing guidelines?
• Have you explained what your changes do, and why they add value?

Please note: we will close your PR without comment if you do not check the boxes above and provide ALL requested information.

---

---

Summary by cubic

Promotes the stage-apps branch into stage. Adds optional Ever ID and Keycloak sign-in plugins (off by default), an anonymous usage statistics plugin with instance identity, and bundles review feedback that shipped on the branch.

Highlights

• Ever ID and Keycloak sign-in register only when explicitly enabled; default installs are unchanged.
• Anonymous usage statistics send one signed daily report when enabled, and stay off on Ever's own deployments.
• Email verification works end to end; links in e-mails only point at origins this deployment serves.
• Desktop agents show in the tray what monitoring captures, and EEA/UK exit/logout restrictions require recorded acknowledgement.

Ops and workflow

• The shipped Sentry DSN is removed; installs must supply their own, or Sentry stays off.
• Postgres migrations run one process at a time to avoid double-execution on multi-process boots.
• PRs into develop no longer start the heavy CI workflows; Docker build records are no longer uploaded, and CodeQL and an egress audit were added.
• Desktop release builds publish to the Snap Store stable channel and assert the per-arch update channel before publishing.