Version cut 1.9.2: close the code review pass, bump the pin

The 2026-08-19 full-tree code review's fixes were sitting in Unreleased
alongside in-progress, docs-only panel-redesign prep. Per development.md
§ Roadmap track, docs-only prep gets no version cut until its product
stage ships, so the review-pass entries (all real code/behaviour fixes,
plus migration 0010, the DMARC-zip and port-25 e2e additions) move to a
new [1.9.2] section; the panel-redesign and preflight roadmap items stay
in a fresh Unreleased. Also drops two duplicate CHANGELOG bullets
(bcrypt cost, rate-limiter eviction) that restated an earlier entry
verbatim, and updates every 1.9.1 pin reference (docker-compose image,
README quickstart, guide.md, development.md's planned-cuts table,
schema-migrations.md's migration-0010 row, roadmap.md's review-closure
links) to 1.9.2.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/roadmap.md

@@ -54,7 +54,7 @@ listed above and none of them urgent: [csrf-tokens](#csrf-tokens),
 [template-data-typing](#template-data-typing),
 [structured-logging](#structured-logging) and
 [review-2026-08-followups](#review-2026-08-followups). What that review
-produced is in [CHANGELOG.md](../CHANGELOG.md) `[Unreleased]`; its own document
+produced is in [CHANGELOG.md](../CHANGELOG.md) `[1.9.2]`; its own document
 was removed once these four items carried everything still open, and stays in
 git history.
 
@@ -262,7 +262,7 @@ estimate: 3–4 hours.
 **Goal:** the leftovers of the 2026-08-19 full-tree code review that are too
 small to be roadmap items of their own. Everything still open from that review
 is in the table below; the rest of it shipped in
-[CHANGELOG.md](../CHANGELOG.md) `[Unreleased]`.
+[CHANGELOG.md](../CHANGELOG.md) `[1.9.2]`.
 
 | Area | Item |
 |---|---|