fix: failover on flow creation, minio image, stable build revisions

- Failover: when the primary provider is down, flow and assistant creation now falls back for the tool call ID template.
- Prompts: a stored custom prompt that no longer validates is ignored in favor of the default, with a warning, instead of rendering "<no value>".
- Security: PUT /users/{hash} refuses a password change without users.edit, so a stolen session cookie can no longer reset the account password.
- Langfuse: minio/minio is gone from Docker Hub, so the stack runs cgr.dev/chainguard/minio:latest as root to keep existing volumes readable.
- Installer: the main menu highlights Maintenance while a worker, stack or installer update is waiting.
- Versions: the build revision is the first 7 characters of the commit SHA instead of git rev-parse --short, which depends on the size of the clone.
- Tests: the docker pids-limit test sets its limit after the probes start, so the setup execs no longer exhaust it on slow CI runners.
- Docs: README covers Azure OpenAI through the custom provider and the Neo4j/APOC files a manual Graphiti install needs.
- Reports: added the Azure OpenAI ctester report and regenerated vllm-mixed for Qwen3.8.

.github/workflows/ci.yml

@@ -152,7 +152,8 @@ jobs:
           TAG_COMMIT=$(git rev-list -n 1 "$LATEST_TAG" 2>/dev/null || echo "")
 
           if [ "$CURRENT_COMMIT" != "$TAG_COMMIT" ]; then
-            PACKAGE_REV=$(git rev-parse --short HEAD)
+            # Fixed width, as in scripts/version.sh: --short widens with the size of the clone.
+            PACKAGE_REV=$(printf '%s' "$CURRENT_COMMIT" | cut -c1-7)
           else
             PACKAGE_REV=""
           fi
@@ -204,7 +205,8 @@ jobs:
 
           # Set revision only if current commit differs from tag commit
           if [ "$CURRENT_COMMIT" != "$TAG_COMMIT" ]; then
-            PACKAGE_REV=$(git rev-parse --short HEAD)
+            # Fixed width, as in scripts/version.sh: --short widens with the size of the clone.
+            PACKAGE_REV=$(printf '%s' "$CURRENT_COMMIT" | cut -c1-7)
             echo "revision=${PACKAGE_REV}" >> $GITHUB_OUTPUT
             echo "is_release=false" >> $GITHUB_OUTPUT
             echo "Building development version: ${VERSION}-${PACKAGE_REV}"