chore(master): release 3.10.0

[github-actions]

🤖 I have created a release beep boop

3.10.0 (2026-06-19)

Features

• api: serve detached update signatures from the downloads endpoint (5c47b2c)
• auth: detect refresh-token reuse and revoke the session family (4c3f4ca)
• client: verify self-update binary signature before install (ad7497d)

Bug Fixes

• api: key rate limiters on real client IP behind trusted proxy (15e4b33)
• billing: block scheduled plan-upgrade bypass on expired subscriptions (783576a)
• core: verify custom-domain target ownership at route time (10e3430)
• daemon: authenticate and guard the local daemon HTTP API (8de300d)
• redis: guard tunnel subdomain claim against cross-node hijack (265ef8b)
• scheduler: downgrade recurring subscriptions after renewal grace period (5b60d51)
• scheduler: run subscription checks under a cluster advisory lock (9debc2c)
• web: point github links to public mirror fxtun.dev repo (ab6a9a3)

---

This PR was generated with Release Please. See documentation.