RMS Mail release v3.0.8

[3.0.8] — 2026-06-19

📬 Camo Image Proxy — Marketing Emails & Reliability

• sanitizeImageURL: marketing mailers (Banana Republic, etc.) emit SOH (0x01) instead of = in image query strings → net/url rejected URLs → /api/media/proxy 502. Fixed at normalize + proxy time.
• Pinned HTTPS fetch: TLS ServerName on IP dial, IPv4 preferred over IPv6, manual redirect follow (up to 5 hops).
• Cache path: camo disk cache under STORAGE_ROOT/camo (not hardcoded relative storage/).
• Graceful failure: upstream fetch errors return 1×1 transparent GIF (200) instead of 502 JSON — no red console spam on broken tracking pixels.
• Timeouts: camo request context 20 s; browser-like User-Agent.

📧 Email Iframe CSP — External Stylesheets

• style-src: 'unsafe-inline' https: — allows <link rel="stylesheet"> from Google Fonts, T-Bank CDN, and other HTTPS marketing CSS (fonts already allowed via font-src https:).
• Scripts still blocked — no script-src in iframe CSP.

ℹ️ About — Version & Update Channel

• GET /api/license: returns app_version (backend binary) and update_channel (stable / beta / alpha from UPDATE_CHANNEL env).
• About tab: shows Stable / Beta / Alpha badge next to vX.Y.Z; version prefers backend app_version over frontend build env.