Potential experiments

fix(platform): parse api error responses in one place (#2355)

fix(app-proxy): validate config, csp sources, cap resource use (#2354)

fix(gateway): rate limit resume like identify (#2353)

fix(gateway): only trust the client ip header when enabled (#2352)

fix(gateway): bound the zstd decompression window (#2351)

fix(read-state): keep a failed ack dispatch from failing acks (#2350)

feat(api): serve well-known discovery with etag and 304 (#2349)

fix(auth): bucket phone attempt risk by v4 and v6 subnet (#2348)

fix(auth): harden login rate keys and totp reuse (#2347)

fix(api): validate push and domain verification targets (#2346)

fix(api): trust recorded upload types and bound edit sizes (#2345)

fix(api): bound storage listings, ranges and search paging (#2344)

fix(captcha): drop the body-email contact policy exemption (#2343)

fix(constants): add captcha, cache and feature headers (#2342)

fix(http-client): validate public addresses at connect time (#2341)

chore(i18n): resync message catalogs with source (#2340)

i18n: regenerate localizations

feat(voice): enable web camera background effects

fix(voice): gate the camera preview and update effects in place

fix(channel): restore composer draft and message focus