Version cut 1.9.2: close the code review pass, bump the pin

The 2026-08-19 full-tree code review's fixes were sitting in Unreleased
alongside in-progress, docs-only panel-redesign prep. Per development.md
§ Roadmap track, docs-only prep gets no version cut until its product
stage ships, so the review-pass entries (all real code/behaviour fixes,
plus migration 0010, the DMARC-zip and port-25 e2e additions) move to a
new [1.9.2] section; the panel-redesign and preflight roadmap items stay
in a fresh Unreleased. Also drops two duplicate CHANGELOG bullets
(bcrypt cost, rate-limiter eviction) that restated an earlier entry
verbatim, and updates every 1.9.1 pin reference (docker-compose image,
README quickstart, guide.md, development.md's planned-cuts table,
schema-migrations.md's migration-0010 row, roadmap.md's review-closure
links) to 1.9.2.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/development.md

@@ -107,7 +107,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 2. Git tag `vX.Y.Z` and publish the GitHub Release only on explicit request (see
    [§ Release image](#release-image)).
 
-**Planned version cuts** (from pin `1.9.1`; adjust if semver changes mid-track):
+**Planned version cuts** (from pin `1.9.2`; adjust if semver changes mid-track):
 
 | Stage | ID | Cut |
 |---|---|---|
@@ -119,7 +119,8 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 | 6 | panel-docs | `1.8.0` |
 | 7 | application auth IPs | `1.9.0` |
 | 8 | port-25 Postfix startup fix | `1.9.1` (PATCH) |
-| 9 | inbound-antispam-panel | `1.10.0` (planned) |
+| 9 | 2026-08-19 code review pass | `1.9.2` (PATCH) |
+| 10 | inbound-antispam-panel | `1.10.0` (planned) |
 
 Docs-only prep (checklists in plans, no product code) uses the same per-step
 commit rule but **no** version cut until the next product stage ships.