Merge branch 'main' into codex/harden-security-20261111

.npmrc

@@ -5,4 +5,4 @@ confirmModulesPurge=false
 # SIAX Cloud publishes @siax/* packages from Gitea's own npm registry.
 # Only scoped @siax/* names resolve here; everything else stays on the
 # public npm registry.
-@siax:registry=https://git.siax.io/api/packages/sax3l/npm/
+@siax:registry=https://git.siax.io/api/packages/admin/npm/

siax/signing/README.md

@@ -1,4 +1,4 @@
 # 0pt — cosign-signeringskedjan (2026-09-29)
 
-Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-116b1df3b8 (sha256:50c3fb070f21e3fc08cf80b78f73f9cba989074c222870e030a2a9e597222874) är cosign-signerad
+Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-4b46e9d3ba (sha256:cc1fbff7302ad9a25566c780a5d8d345cbd9b8c7b32dbfc402ee3f2ee2c2de26) är cosign-signerad
 med nyckelparet vars pubkey ligger här. Privata nyckeln raderad efter signering.

siax/signing/cosign.pub

@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERHWjVOzdRfPM1NY3KVCZBNSq+BM7
-pkWaB59iqNSVjO5P/dvcd7YisP7z9M3p4yOKQwEQxek3/tBCfhNOPN0XJA==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE13AJi5zkXyURoh0H8Y+LeWa5q/ct
+SFlEt1z00Cc9vU2eVgFELUnhgn9rO8+Rng4kWJOGVvyQS+3zpMwhsIlddg==
 -----END PUBLIC KEY-----