odysseus

fix(cookbook): don't infer server OS from the browser's user-agent (#3223)

fix(rag): forward owner through manager wrapper (#2991)

fix(personal): require document privilege for rag upload (#2990)

fix(auth): gate api tokens from user routes (#2992)

Harden note reminder dispatch ownership (#2999)