Version cut 1.9.2: close the code review pass, bump the pin

The 2026-08-19 full-tree code review's fixes were sitting in Unreleased
alongside in-progress, docs-only panel-redesign prep. Per development.md
§ Roadmap track, docs-only prep gets no version cut until its product
stage ships, so the review-pass entries (all real code/behaviour fixes,
plus migration 0010, the DMARC-zip and port-25 e2e additions) move to a
new [1.9.2] section; the panel-redesign and preflight roadmap items stay
in a fresh Unreleased. Also drops two duplicate CHANGELOG bullets
(bcrypt cost, rate-limiter eviction) that restated an earlier entry
verbatim, and updates every 1.9.1 pin reference (docker-compose image,
README quickstart, guide.md, development.md's planned-cuts table,
schema-migrations.md's migration-0010 row, roadmap.md's review-closure
links) to 1.9.2.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,22 +5,6 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
-Review pass over `1.4.0`…`1.9.1`: port 25 no longer shares the submission
-milter chain, DMARC reports are validated before they are stored, and the auto
-rate limit is correct for a non-default level-1 window. Schema migration
-`0010` (index only). Upgrading is a tag bump.
-
-A full-tree code review on 2026-08-19 (architecture, code quality, security,
-GUI, tests, documentation, AGPL compliance; 38 findings) produced most of what
-follows. Its four open items live in [roadmap.md](docs/roadmap.md); its working
-document is not part of the release.
-
-### Changed
-
-- README hero line and a **Positioning** block in `docs/product.md` record the
-  tagline (`YOUR SMTP. YOUR RULES.`) and hero copy; the stamp subtitle stays
-  `SELF-HOSTED SMTP RELAY`. `docs/assets/selfpost-proof.html` updated to match.
-
 ### Added
 
 - Panel redesign, account e-mail and notifications: a user's e-mail is its own
@@ -155,6 +139,21 @@ document is not part of the release.
   ([docs/plans/preflight.md](docs/plans/preflight.md)) — instance-level
   infrastructure verification (rDNS, TLS, ports, HELO banner, proxy headers,
   DKIM socket, test email). Status: candidate.
+
+## [1.9.2] - 2026-09-22
+
+Review pass over `1.4.0`…`1.9.1`: port 25 no longer shares the submission
+milter chain, DMARC reports are validated before they are stored, and the auto
+rate limit is correct for a non-default level-1 window. Schema migration
+`0010` (index only). Upgrading is a tag bump.
+
+A full-tree code review on 2026-08-19 (architecture, code quality, security,
+GUI, tests, documentation, AGPL compliance; 38 findings) produced most of what
+follows. Its four open items live in [roadmap.md](docs/roadmap.md); its working
+document is not part of the release.
+
+### Added
+
 - SQLite migration `0010_send_log_app_login_index.sql` —
   `idx_send_log_app_login_created_at`. The journal-milter counts an
   application's messages on every `MAIL FROM`, and the domain page computes
@@ -170,6 +169,12 @@ document is not part of the release.
   survived three releases because the suite only ever exercised the flags-off
   path.
 
+### Changed
+
+- README hero line and a **Positioning** block in `docs/product.md` record the
+  tagline (`YOUR SMTP. YOUR RULES.`) and hero copy; the stamp subtitle stays
+  `SELF-HOSTED SMTP RELAY`. `docs/assets/selfpost-proof.html` updated to match.
+
 ### Fixed
 
 - The setup account's password is hashed at bcrypt cost `12` like every other
@@ -199,17 +204,12 @@ document is not part of the release.
   guard; one check now returns a context-specific message for self-demotion.
 - Settings flash text now reflects what actually changed and only mentions
   session sign-out when the password changed.
-- Login/setup rate-limiter bucket eviction now prefers the nearest-expiry bucket
-  and does not evict currently blocked buckets.
 - Help page/drawer links now use `SourceURL` (`{{.SourceURL}}/blob/main/docs/...`)
   instead of a hardcoded repository URL.
 - Help drawer close controls include accessibility attributes (`role="button"`,
   `aria-label`) for the scrim and close action.
-- Password hashing now uses explicit bcrypt cost `12` in settings/user password
-  updates, instead of `bcrypt.DefaultCost`.
 - Test coverage expanded for DMARC map token injection rejection and email
   validation edge cases (ASCII/local-part/domain/freemail cases).
-
 - **Port 25 no longer runs the submission milter chain.** `smtpd_milters` is
   now always overridden on `smtp/inet` — to the optional antispam milter, or
   to nothing. Previously, with `INBOUND_ANTISPAM_MILTER` unset, inbound mail