chore(dev): release 5.1.0

[github-actions]

🤖 I have created a release beep boop

5.1.0 (2026-06-16)

Features

• login: confirm before clobber, faster polling, surface auth errors (6b0f616)
• login: pick org in the CLI, hide ids from users (4130c3e)
• login: replace loopback with PKCE device-code polling (135f486)
• ship CLI lifecycle/error telemetry to /cli/logs (001d3ba)
• standalone binary distribution via curl|sh (f491caf)

Bug Fixes

• address correctness and security findings from full code review (db33830)
• address full code-review findings (correctness, security, CI) (2bf88a1)
• create parent directories when writing JSON output files (ba895cc)
• deps: bump brace-expansion and ws overrides for CVE patches (5692c9d)
• deps: override esbuild to >=0.28.1 for GHSA-gv7w-rqvm-qjhr (cdd9e7f)
• deps: override esbuild to >=0.28.1 for GHSA-gv7w-rqvm-qjhr (f476ea8)
• enable TypeScript strict mode and type-check tests in CI (369eb2a)
• enable TypeScript strict mode and type-check tests in CI (bb1d769)
• honor logged-in env for api-url, stop live menu leak, fix --env docs (4fee5a6)
• honor logged-in env for api-url, stop live menu leak, fix --env docs (8c9fee0)
• login: accept POST /callback with JSON body + origin-scoped CORS (79ec77d)
• stream uploads from disk instead of holding binaries in memory (0af9d50)
• stream uploads from disk instead of holding binaries in memory (91b4332)

Dependencies

• swap app-info-parser for node-apk, drop consola/ts-node/@types/tar (15bafe3)
• swap archiver for yazl, glob for fs.globSync (a420a95)

Code Refactoring

• move live session types to src/types/domain (f0082fa)
• route live session commands through ApiGateway (6757aa5)
• route live session commands through ApiGateway (c63f3c2)

---

This PR was generated with Release Please. See documentation.