fix: failover on flow creation, minio image, stable build revisions

- Failover: when the primary provider is down, flow and assistant creation now falls back for the tool call ID template.
- Prompts: a stored custom prompt that no longer validates is ignored in favor of the default, with a warning, instead of rendering "<no value>".
- Security: PUT /users/{hash} refuses a password change without users.edit, so a stolen session cookie can no longer reset the account password.
- Langfuse: minio/minio is gone from Docker Hub, so the stack runs cgr.dev/chainguard/minio:latest as root to keep existing volumes readable.
- Installer: the main menu highlights Maintenance while a worker, stack or installer update is waiting.
- Versions: the build revision is the first 7 characters of the commit SHA instead of git rev-parse --short, which depends on the size of the clone.
- Tests: the docker pids-limit test sets its limit after the probes start, so the setup execs no longer exhaust it on slow CI runners.
- Docs: README covers Azure OpenAI through the custom provider and the Neo4j/APOC files a manual Graphiti install needs.
- Reports: added the Azure OpenAI ctester report and regenerated vllm-mixed for Qwen3.8.

scripts/version.ps1

@@ -28,7 +28,8 @@ $tagCommit = git rev-list -n 1 $latestTag 2>$null
 
 # Set revision only if current commit differs from tag commit
 if ($currentCommit -and ($currentCommit -ne $tagCommit)) {
-    $env:PACKAGE_REV = git rev-parse --short HEAD
+    # A fixed width, not --short: git widens the abbreviation with the size of the clone.
+    $env:PACKAGE_REV = $currentCommit.Substring(0, 7)
     $buildType = "development"
 } else {
     $env:PACKAGE_REV = ""

scripts/version.sh

@@ -26,7 +26,9 @@ TAG_COMMIT=$(git rev-list -n 1 "$LATEST_TAG" 2>/dev/null || echo "")
 
 # Set revision only if current commit differs from tag commit
 if [ -n "$CURRENT_COMMIT" ] && [ "$CURRENT_COMMIT" != "$TAG_COMMIT" ]; then
-    PACKAGE_REV=$(git rev-parse --short HEAD)
+    # A fixed width, not --short: git widens the abbreviation with the size of the clone,
+    # so CI and a developer checkout would stamp the same commit with different revisions.
+    PACKAGE_REV=$(printf '%s' "$CURRENT_COMMIT" | cut -c1-7)
 else
     PACKAGE_REV=""
 fi