SECURITY: [DNS] zone permission checks missing in multiple add_record()/remove_record() implementations. NEW: [common] set-preference(), set a single preference value using dot notation. [UI] Onboarding tours (see Customizing.md). FIXED: [DNS] provisioning fails on incomplete DKIM setup. [Let's Encrypt] incorrect hostname variant appended if absent during requests and [letsencrypt] => alternative_form enabled. [Login] "password" field position reverts after password entry. [Metrics] TimescaleDB v2 loader conflicts with version detection. [UI] Layout method (_layout()) called twice during page render. [Web Apps] options serialized as object always return "true" for auto-update policy. CHANGED: [apnscpd] convert service type to sd_notify, which allows for cgroup controllers to be mounted within each account prior to virtualcron service. [DNS] add double-throw safety switch, require setting dns,enabled=0 + dns,provider=null to remove a zone on edit. [Reseller] rewrite subordinate <=> parent relationship. billing.parentmap now contains a 1:1 association of subordinates to parents instead of invoices to subordinate sites. [Scopes] dns.ip4-pool, dns.ip6-pool- cap max namebased IPs to 64. [Web Apps] always reapply reconfigurables during install if a Web App were previously located.