Release v2.20.1: migrate authentication to Better Auth

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.20.1 - 2026-10-25
+
+### Changed
+
+- Removed restart-bound session lifetime and active-session limit controls and inactive login-throttling controls. Sessions now use a fixed 14-day lifetime with no active-session cap; sign-in request limits use Better Auth's built-in policy. Added a migration to remove the retired settings from the database.
+- Clarified the scope of resetting sign-in and two-factor request limits, retained the account-level authenticator lockouts, and exposed the administrator email-verification bypass setting.
+
+## 2.20.0 - 2026-10-25
+
+### Added
+
+- Migrated sign-in, sessions, credentials, and identity fields to Better Auth while preserving application user IDs and roles. Existing password hashes are migrated and upgraded to scrypt after successful sign-in; existing sessions are invalidated once. Configure a stable `AUTH_SECRET` before startup.
+- Added email OTP flows for address verification, email changes, and password recovery with configurable expiry and restricted-MySQL-compatible account synchronization.
+- Added optional authenticator-based two-factor authentication with recovery codes, trusted devices, and role-required enrollment.
+- Added passkey registration, sign-in, and account management, plus administrator controls to unlink a user's passkeys and authenticators.
+- Added per-user password-change requirements and direct administrator account creation without invitations.
+- Added compact auditing across content updates that records only changed fields, matches template regions by stable keys, fingerprints generated QR assets instead of storing their payloads, and skips empty update records. Playlist auditing includes slide order, durations, grouping, and schedules. Existing audit history is preserved.
+
 ## 2.19.3 - 2026-10-25
 
 ### Added