Merge origin/main into chore/optimize-ci-path-filters

Resolves conflicts by:
- Keeping path filter optimization (changes job + conditional skipping)
- Adopting pnpm package manager from main
- Upgrading GitHub Actions to v4 for security/performance
- Updating lock file path from package-lock.json to pnpm-lock.yaml
- Changing npm commands to pnpm equivalents
- Removing redundant npm-based changeset entry

Author: phoenix-server

.changeset/bright-clocks-jam.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Migrate project tooling from npm to pnpm across CI workflows, Docker setup, hooks, and contributor commands.

.changeset/brown-bears-pay.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+fix: maxLimit checks added to subscription message handler

.changeset/bump-uuid-to-v14.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Bump dev dependency uuid from 8.3.2 to 14.0.0

.changeset/callback-routes-conditional-registration.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+refactor: only register OpenNode, LNbits, and Zebedee callback routes when their processor is active

.changeset/crisp-paws-own.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+fix: close dead connections even if they have active subscriptions

.changeset/dark-places-tickle.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Fix root HTML negotiation and subpath-aware template links behind trusted proxies.

.changeset/expire-stale-lnbits-invoices.md

@@ -0,0 +1,5 @@
+---
+'nostream': patch
+---
+
+Expire stale pending invoices when LNbits no longer has the invoice or reports it as unpaid past its expiry time.

.changeset/fix-serialize-javascript-cve.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Security: override serialize-javascript to >=7.0.3 (CVE RCE, GHSA-5c6j-r48x-rmvq)

.changeset/generic-tags-empty-values.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Allow generic tag filters to match empty string tag values.

.changeset/geohash-prefix-filters.md

@@ -0,0 +1,9 @@
+---
+"nostream": patch
+---
+
+Implement geohash wildcard/prefix behavior for `#g` filters (closes #265): a
+criterion ending in `*` matches any event `g` tag whose value starts with the
+prefix before `*`; exact matching (no `*`) is unchanged. Only normal geohash
+prefixes are intended as input. This is a Nostream extension, not part of
+NIP-12.