Add embed visitor principals (X-Embed-Visitor), widen sessions.user_id, embed MCP OAuth/approval routes, OAuth callback context detachment, and CloneContext principal preservation for async QA streams.
Introduce embed_channels storage, publish-token and session-token auth, origin allowlist enforcement, shared Redis rate limiter, public embed API routes, webhooks with SSRF validation, and session listing by embed source.
wizardchen