* feat: full per-provider model lists with release-time auto-refresh and dedicated custom model field
* feat: add setup help widget to API node (Windows/Linux API key instructions)
* Add OpenAI-compatible API node
* Document OpenAI-compatible API node
* Harden API credentials with server-side profiles
* Ignore local API profile and env files
* Add server-side API profile example
* Document hardened server-side API profiles
* Add API profile security regression tests
* Make API security test loader standalone
* Use generic model ID in API profile example
* docs: expand secure API deployment and secret handling guide
* Harden API transport and request controls
* Fix Python booleans in hardened API node
* Expand API security regression tests
* Update secure API profile examples
* Ignore local API profile variants
* Document hardened API deployment and threat model
* Add CI for API security regressions
* Cap Qwen thinking budget and fail closed on invalid overrides
* Cover thinking budget and fail-closed profile overrides
* Document thinking-budget limits and fail-closed overrides
* Run API security CI for docs and policy changes
Marcel Hofer