…p-v3

* main: (105 commits)
  website/docs: Custom CSS (#19991)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770992049 (#20285)
  stage/invitation: Send invite via email UI (#19823)
  root: remove unused `django-cte` (#20090)
  core: bump ruff from 0.15.0 to 0.15.1 (#20273)
  core, web: update translations (#20271)
  ci: bump docker/build-push-action from 6.19.1 to 6.19.2 (#20274)
  enterprise/lifecycle: fix multiple reviews showing up in "Reviews" when the user is a member of multiple reviewer groups (#20266)
  ci: fix binary outpost build on release (#20248)
  web: add pretty names for lifecycle review events in event logs (#20264)
  web: fix italic formatting in lifecycle rule help text (#20263)
  website/docs: 2025.8.6 release notes (#20243)
  website/docs: 2025.12.4 release notes (#20226)
  website/docs: 2025.10.4 release notes (#20242)
  security: CVE-2026-25748 (#20240)
  security: CVE-2026-25922 (#20241)
  security: CVE-2026-25227 (#20239)
  ci: fix release testing (#20207)
  core: Apply CSpell corrections. (#20191)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770842608 (#20213)
  ...

…web/flow/tablize-token-component-relationship

* web/flow/tablize-token-component-relationship-v3: (75 commits)
  Removed the cache; it's extra code for no benefit whatsoever; the table is constructed ONCE at start-up, there's never going to be a cache hit.  The FlowExecutorStageFactory produces StageMappings (StageMapping[]), which is itself a warehouse of singular server-component -> client-component relationships, fetching the client from the bundle as needed.  The StageMapping only does the fetch once per instance, so (for example) a password failure will reinstantiate a PasswordStage, but it will not fetch it a second time.
  Tidy.
  website/docs: Custom CSS (#19991)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770992049 (#20285)
  stage/invitation: Send invite via email UI (#19823)
  root: remove unused `django-cte` (#20090)
  core: bump ruff from 0.15.0 to 0.15.1 (#20273)
  core, web: update translations (#20271)
  ci: bump docker/build-push-action from 6.19.1 to 6.19.2 (#20274)
  enterprise/lifecycle: fix multiple reviews showing up in "Reviews" when the user is a member of multiple reviewer groups (#20266)
  ci: fix binary outpost build on release (#20248)
  web: add pretty names for lifecycle review events in event logs (#20264)
  web: fix italic formatting in lifecycle rule help text (#20263)
  website/docs: 2025.8.6 release notes (#20243)
  website/docs: 2025.12.4 release notes (#20226)
  website/docs: 2025.10.4 release notes (#20242)
  security: CVE-2026-25748 (#20240)
  security: CVE-2026-25922 (#20241)
  security: CVE-2026-25227 (#20239)
  ci: fix release testing (#20207)
  ...

…/flow/20030-one-true-api

* web/flow/tablize-token-component-relationship: (76 commits)
  Removed comments about the cache.  Added comments about where to find the FlowExecutor stage table. Moved the import of WebAuthnAuthenticticatorRegisterState from FlowExecutor.ts to FlowExecutorStages.ts; both files are bundled together, so this is a no-op functionally, but it's easier to confirm that StageEntries without import expressions (STageModuleCallbacks) have their stages bundled (pre-imported) if the import statement is in the same file.
  Removed the cache; it's extra code for no benefit whatsoever; the table is constructed ONCE at start-up, there's never going to be a cache hit.  The FlowExecutorStageFactory produces StageMappings (StageMapping[]), which is itself a warehouse of singular server-component -> client-component relationships, fetching the client from the bundle as needed.  The StageMapping only does the fetch once per instance, so (for example) a password failure will reinstantiate a PasswordStage, but it will not fetch it a second time.
  Tidy.
  website/docs: Custom CSS (#19991)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770992049 (#20285)
  stage/invitation: Send invite via email UI (#19823)
  root: remove unused `django-cte` (#20090)
  core: bump ruff from 0.15.0 to 0.15.1 (#20273)
  core, web: update translations (#20271)
  ci: bump docker/build-push-action from 6.19.1 to 6.19.2 (#20274)
  enterprise/lifecycle: fix multiple reviews showing up in "Reviews" when the user is a member of multiple reviewer groups (#20266)
  ci: fix binary outpost build on release (#20248)
  web: add pretty names for lifecycle review events in event logs (#20264)
  web: fix italic formatting in lifecycle rule help text (#20263)
  website/docs: 2025.8.6 release notes (#20243)
  website/docs: 2025.12.4 release notes (#20226)
  website/docs: 2025.10.4 release notes (#20242)
  security: CVE-2026-25748 (#20240)
  security: CVE-2026-25922 (#20241)
  security: CVE-2026-25227 (#20239)
  ...

…t-flow-inspector

* web/flow/20030-one-true-api:
  Removed comments about the cache.  Added comments about where to find the FlowExecutor stage table. Moved the import of WebAuthnAuthenticticatorRegisterState from FlowExecutor.ts to FlowExecutorStages.ts; both files are bundled together, so this is a no-op functionally, but it's easier to confirm that StageEntries without import expressions (STageModuleCallbacks) have their stages bundled (pre-imported) if the import statement is in the same file.
  Removed the cache; it's extra code for no benefit whatsoever; the table is constructed ONCE at start-up, there's never going to be a cache hit.  The FlowExecutorStageFactory produces StageMappings (StageMapping[]), which is itself a warehouse of singular server-component -> client-component relationships, fetching the client from the bundle as needed.  The StageMapping only does the fetch once per instance, so (for example) a password failure will reinstantiate a PasswordStage, but it will not fetch it a second time.
  Tidy.
  website/docs: Custom CSS (#19991)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770992049 (#20285)
  stage/invitation: Send invite via email UI (#19823)
  root: remove unused `django-cte` (#20090)
  core: bump ruff from 0.15.0 to 0.15.1 (#20273)
  core, web: update translations (#20271)
  ci: bump docker/build-push-action from 6.19.1 to 6.19.2 (#20274)
  enterprise/lifecycle: fix multiple reviews showing up in "Reviews" when the user is a member of multiple reviewer groups (#20266)
  ci: fix binary outpost build on release (#20248)
  web: add pretty names for lifecycle review events in event logs (#20264)
  web: fix italic formatting in lifecycle rule help text (#20263)
  website/docs: 2025.8.6 release notes (#20243)
  web/flow: optimize table for type safety
  web: Flesh out module driven tag names.

…261-tidy-identification-stage

* web/flow/20063-extract-flow-inspector:
  Move the inspector into its own folder.
  Since the check for `this.can(CapabilitiesEnum.CanDebug))` has been moved into the FlowInspectorButton, FlowExecutor no longer needs the capabilities check at all.
  Of COURSE prettier had opinions!
  Removed comments about the cache.  Added comments about where to find the FlowExecutor stage table. Moved the import of WebAuthnAuthenticticatorRegisterState from FlowExecutor.ts to FlowExecutorStages.ts; both files are bundled together, so this is a no-op functionally, but it's easier to confirm that StageEntries without import expressions (STageModuleCallbacks) have their stages bundled (pre-imported) if the import statement is in the same file.
  Removed the cache; it's extra code for no benefit whatsoever; the table is constructed ONCE at start-up, there's never going to be a cache hit.  The FlowExecutorStageFactory produces StageMappings (StageMapping[]), which is itself a warehouse of singular server-component -> client-component relationships, fetching the client from the bundle as needed.  The StageMapping only does the fetch once per instance, so (for example) a password failure will reinstantiate a PasswordStage, but it will not fetch it a second time.
  Tidy.
  website/docs: Custom CSS (#19991)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770992049 (#20285)
  stage/invitation: Send invite via email UI (#19823)
  root: remove unused `django-cte` (#20090)
  core: bump ruff from 0.15.0 to 0.15.1 (#20273)
  core, web: update translations (#20271)
  ci: bump docker/build-push-action from 6.19.1 to 6.19.2 (#20274)
  enterprise/lifecycle: fix multiple reviews showing up in "Reviews" when the user is a member of multiple reviewer groups (#20266)
  ci: fix binary outpost build on release (#20248)
  web: add pretty names for lifecycle review events in event logs (#20264)
  web: fix italic formatting in lifecycle rule help text (#20263)
  website/docs: 2025.8.6 release notes (#20243)
  web/flow: optimize table for type safety
  web: Flesh out module driven tag names.