chore(release): v0.4.3

[rmyndharis]

Batch release v0.4.3 — bundles 13 merged PRs (security hardening, reliability fixes, stuck-session recovery + dashboard button, docs). No breaking changes for a correctly-configured deployment.

All 13 branches were integrated locally, conflicts resolved (the withSafeFetch↔WEBHOOK_TIMEOUT overlap in the webhook path, and the forwardMessage/forceDestroy spec blocks), and the combined tree passes the full gate: backend 880/880, lint + build + dashboard clean.

Included PRs

Added

• feat(session): force-kill a stuck session (engine forceDestroy + POST /sessions/:id/force-kill) #352 — force-kill a stuck session (POST /sessions/:id/force-kill, engine forceDestroy())
• feat(dashboard): Kill Stuck button for failed sessions #351 — dashboard "Kill Stuck" button (@Abhishekrajpurohit)

Security / hardening

• fix(security): pin outbound webhook and media fetches to the SSRF-validated IP #338 — pin outbound webhook + media fetches to the SSRF-validated IP (DNS-rebinding)
• fix(security): harden outbound requests — IPv6 SSRF embeddings, LibreTranslate guard, proxy validation #344 — IPv6 SSRF embeddings, LibreTranslate guard, proxyUrl validation
• fix(security): tighten secret-file perms, optional key pepper, validate allowedIps, proxy-aware queue-UI auth #345 — secret-file perms, opt-in API-key pepper, allowedIps validation, queue-UI IP model, S3 secret-guard
• fix(storage): bound tar imports, contain storage keys across backends, stop export-file accumulation #346 — tar-import caps, S3 key containment, plugin-storage sandbox, export TTL-sweep

Fixed

• fix(webhook): deliver session lifecycle events and key them per occurrence #335 — deliver session-lifecycle webhook events (n8n event names corrected)
• fix(plugins): persist plugin enable/config and restore configuration on restart #339 — persist plugin enable/config across restarts
• fix(message): persist bulk-sent messages, sanitize SSRF errors, honor cross-instance cancel #340 — persist bulk-sent messages, sanitize SSRF errors, cross-instance cancel
• fix(engine): return the real id for forwarded messages on whatsapp-web.js so delivery status advances #341 — return the real id for forwarded messages (delivery status advances)
• fix(session): reconcile late acks, serialize concurrent reactions, harden hook + ack error paths #348 — reconcile late acks, serialize concurrent reactions, hook error-gate, ack .catch
• fix(contract): honor webhook timeout, bound shutdown, unify unsupported-op 501, validate engine/storage env #350 — honor WEBHOOK_TIMEOUT (queued/test), bound shutdown, unify unsupported→501, env validation, metrics memo

Docs

• docs: add phone-number pairing example #343 — phone-number pairing example (@hsnyvsh)

Not included

• feat(engine): engine-neutral WhatsApp identities (Baileys inbound conformance) #342 (engine-neutral identity) — changes requested (two regressions from one-sided lid canonicalization); ships in a later release once addressed.
• modify the toast notification system to prevent spamming #293 — unrelated, not reviewed.

Release steps after merge

Tag v0.4.3, cut the GitHub release from the CHANGELOG, and close the 13 PRs above referencing this release.