Version cut 1.9.2: close the code review pass, bump the pin

The 2026-08-19 full-tree code review's fixes were sitting in Unreleased
alongside in-progress, docs-only panel-redesign prep. Per development.md
§ Roadmap track, docs-only prep gets no version cut until its product
stage ships, so the review-pass entries (all real code/behaviour fixes,
plus migration 0010, the DMARC-zip and port-25 e2e additions) move to a
new [1.9.2] section; the panel-redesign and preflight roadmap items stay
in a fresh Unreleased. Also drops two duplicate CHANGELOG bullets
(bcrypt cost, rate-limiter eviction) that restated an earlier entry
verbatim, and updates every 1.9.1 pin reference (docker-compose image,
README quickstart, guide.md, development.md's planned-cuts table,
schema-migrations.md's migration-0010 row, roadmap.md's review-closure
links) to 1.9.2.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/development.md

@@ -107,7 +107,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 2. Git tag `vX.Y.Z` and publish the GitHub Release only on explicit request (see
    [§ Release image](#release-image)).
 
-**Planned version cuts** (from pin `1.9.1`; adjust if semver changes mid-track):
+**Planned version cuts** (from pin `1.9.2`; adjust if semver changes mid-track):
 
 | Stage | ID | Cut |
 |---|---|---|
@@ -119,7 +119,8 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 | 6 | panel-docs | `1.8.0` |
 | 7 | application auth IPs | `1.9.0` |
 | 8 | port-25 Postfix startup fix | `1.9.1` (PATCH) |
-| 9 | inbound-antispam-panel | `1.10.0` (planned) |
+| 9 | 2026-08-19 code review pass | `1.9.2` (PATCH) |
+| 10 | inbound-antispam-panel | `1.10.0` (planned) |
 
 Docs-only prep (checklists in plans, no product code) uses the same per-step
 commit rule but **no** version cut until the next product stage ships.

docs/guide.md

@@ -173,7 +173,7 @@ cat ./data/setup-token
 #### Fixed image tag
 
 `deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
-deliberately never `:latest`. The current pin is `1.9.1`. Intermediate
+deliberately never `:latest`. The current pin is `1.9.2`. Intermediate
 CHANGELOG sections (`0.2.0`…`0.6.0`) record development cuts from before that
 image was published. Pinning matters because of the backup version check (see
 [Full backup and restore](#full-backup-and-restore)): the panel binary's

docs/roadmap.md

@@ -54,7 +54,7 @@ listed above and none of them urgent: [csrf-tokens](#csrf-tokens),
 [template-data-typing](#template-data-typing),
 [structured-logging](#structured-logging) and
 [review-2026-08-followups](#review-2026-08-followups). What that review
-produced is in [CHANGELOG.md](../CHANGELOG.md) `[Unreleased]`; its own document
+produced is in [CHANGELOG.md](../CHANGELOG.md) `[1.9.2]`; its own document
 was removed once these four items carried everything still open, and stays in
 git history.
 
@@ -262,7 +262,7 @@ estimate: 3–4 hours.
 **Goal:** the leftovers of the 2026-08-19 full-tree code review that are too
 small to be roadmap items of their own. Everything still open from that review
 is in the table below; the rest of it shipped in
-[CHANGELOG.md](../CHANGELOG.md) `[Unreleased]`.
+[CHANGELOG.md](../CHANGELOG.md) `[1.9.2]`.
 
 | Area | Item |
 |---|---|

docs/schema-migrations.md

@@ -23,9 +23,9 @@ Documentation.
 | Database file | `/data/selfpost.db` (bind mount) |
 | Compatibility | 1.x MINOR releases must boot a `1.0.0` data directory |
 
-Last updated in **[Unreleased]** (`0010_send_log_app_login_index`); **1.9.1**
+Last updated in **[1.9.2]** (`0010_send_log_app_login_index`); **1.9.1**
 had no schema change. The release column below records the cut a migration
-shipped in — fill `0010`'s in at the next version cut.
+shipped in.
 
 ---
 
@@ -65,7 +65,7 @@ replace the embedded set (see [Planned 2.x squash](#planned-2x-squash)).
 | 7 | `0007_rate_limit_auto.sql` | 1.6.0 | DDL | `rate_limits.mode`, `auto_multiplier`, `auto_updated_at` |
 | 8 | `0008_dmarc_reports.sql` | 1.7.0 | DDL | `dmarc_reports`, `dmarc_report_records` |
 | 9 | `0009_application_auth_ips.sql` | 1.9.0 | DDL + data | `applications.auth_ip_restrict`, `auth_allowed_ips`; move legacy app `rate_limits.allowed_ips` into auth columns; clear those IPs on rate limits |
-| 10 | `0010_send_log_app_login_index.sql` | Unreleased | DDL | `idx_send_log_app_login_created_at` — app-scoped rate-limit counts and per-application send statistics were scanning the `created_at` range |
+| 10 | `0010_send_log_app_login_index.sql` | 1.9.2 | DDL | `idx_send_log_app_login_created_at` — app-scoped rate-limit counts and per-application send statistics were scanning the `created_at` range |
 
 **Kind:** *DDL* — schema only; *data* — `INSERT`/`UPDATE` that must stay correct
 for operators upgrading from older 1.x images.